From: Johan Hovold johan+linaro@kernel.org
stable inclusion from stable-v6.6.31 commit ba307abed5e09759845c735ba036f8c12f55b209 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TN2K CVE: CVE-2024-36033
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
commit 0adcf6be1445ed50bfd4a451a7a782568f270197 upstream.
Add the missing sanity check when fetching the board id to avoid leaking slab data when later requesting the firmware.
Fixes: a7f8dedb4be2 ("Bluetooth: qca: add support for QCA2066") Cc: stable@vger.kernel.org # 6.7 Cc: Tim Jiang quic_tjiang@quicinc.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Felix Fu fuzhen5@huawei.com --- drivers/bluetooth/btqca.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c index 35fb26cbf229..47ea1e909476 100644 --- a/drivers/bluetooth/btqca.c +++ b/drivers/bluetooth/btqca.c @@ -259,6 +259,11 @@ static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid) goto out; }
+ if (skb->len < 3) { + err = -EILSEQ; + goto out; + } + *bid = (edl->data[1] << 8) + edl->data[2]; bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);
From: Felix Fu fuzhen5@huawei.com
Signed-off-by: Felix Fu fuzhen5@huawei.com --- drivers/firmware/efi/libstub/kaslr.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/firmware/efi/libstub/kaslr.c b/drivers/firmware/efi/libstub/kaslr.c index 1a9808012abd..a29ae4c99ffb 100644 --- a/drivers/firmware/efi/libstub/kaslr.c +++ b/drivers/firmware/efi/libstub/kaslr.c @@ -37,6 +37,7 @@ u32 efi_kaslr_get_phys_seed(efi_handle_t image_handle) if (status == EFI_SUCCESS) { return phys_seed; } else if (status == EFI_NOT_FOUND) { + return phys_seed; efi_info("EFI_RNG_PROTOCOL unavailable\n"); efi_nokaslr = true; } else if (status != EFI_SUCCESS) { @@ -112,11 +113,13 @@ efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr, efi_status_t status; u64 min_kimg_align = efi_get_kimg_min_align();
+ phys_seed = 1; if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && phys_seed != 0) { /* * If KASLR is enabled, and we have some randomness available, * locate the kernel at a randomized offset in physical memory. */ + phys_seed = 0; status = efi_random_alloc(*reserve_size, min_kimg_align, reserve_addr, phys_seed, EFI_LOADER_CODE, 0, EFI_ALLOC_LIMIT);
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/9963 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/R...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/9963 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/R...
-
felix -
patchwork bot