December 2022 - Linux-stable-mirror

by Greg Kroah-Hartman

I'm announcing the release of the 6.0.15 kernel. All users of the 6.0 kernel series must upgrade. The updated 6.0.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.0.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/security/keys/trusted-encrypted.rst | 3 Makefile | 2 drivers/net/ethernet/intel/igb/igb_main.c | 2 drivers/net/loopback.c | 2 drivers/pci/controller/pcie-mt7621.c | 3 drivers/usb/dwc3/dwc3-pci.c | 2 drivers/usb/gadget/function/f_uvc.c | 5 drivers/usb/host/xhci-pci.c | 4 drivers/usb/serial/cp210x.c | 2 drivers/usb/serial/f81232.c | 12 - drivers/usb/serial/f81534.c | 12 - drivers/usb/serial/option.c | 3 drivers/usb/typec/ucsi/ucsi.c | 17 + drivers/usb/typec/ucsi/ucsi.h | 1 fs/udf/inode.c | 76 +++---- fs/udf/truncate.c | 48 +--- include/linux/module.h | 9 kernel/module/kallsyms.c | 2 kernel/trace/bpf_trace.c | 98 +++++++++- kernel/trace/ftrace.c | 16 + net/bluetooth/l2cap_core.c | 3 security/keys/encrypted-keys/encrypted.c | 6 sound/pci/hda/patch_realtek.c | 2 tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c | 24 ++ tools/testing/selftests/bpf/prog_tests/kprobe_multi_testmod_test.c | 89 +++++++++ tools/testing/selftests/bpf/prog_tests/module_attach.c | 7 tools/testing/selftests/bpf/progs/kprobe_multi.c | 50 +++++ tools/testing/selftests/bpf/progs/test_module_attach.c | 6 tools/testing/selftests/bpf/trace_helpers.c | 20 +- tools/testing/selftests/bpf/trace_helpers.h | 2 tools/testing/selftests/net/toeplitz.sh | 2 31 files changed, 410 insertions(+), 120 deletions(-) Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook Bruno Thomsen (1): USB: serial: cp210x: add Kamstrup RF sniffer PIDs Duke Xin (1): USB: serial: option: add Quectel EM05-G modem Greg Kroah-Hartman (1): Linux 6.0.15 Heikki Krogerus (1): usb: typec: ucsi: Resume in separate work Jan Kara (4): udf: Discard preallocation before extending file with a hole udf: Fix preallocation discarding at indirect extent boundary udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size udf: Fix extending file within last block Jiri Olsa (8): kallsyms: Make module_kallsyms_on_each_symbol generally available ftrace: Add support to resolve module symbols in ftrace_lookup_symbols bpf: Rename __bpf_kprobe_multi_cookie_cmp to bpf_kprobe_multi_addrs_cmp bpf: Take module reference on kprobe_multi link selftests/bpf: Add load_kallsyms_refresh function selftests/bpf: Add bpf_testmod_fentry_* functions selftests/bpf: Add kprobe_multi check to module attach test selftests/bpf: Add kprobe_multi kmod attach api tests Johan Hovold (2): USB: serial: f81232: fix division by zero on line-speed change USB: serial: f81534: fix division by zero on line-speed change John Thomson (1): PCI: mt7621: Add sentinel to quirks table Nikolaus Voss (1): KEYS: encrypted: fix key instantiation with user-provided data Rasmus Villemoes (1): net: loopback: use NET_NAME_PREDICTABLE for name_assign_type Reka Norman (1): xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N Shruthi Sanil (1): usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system for Raptor Lake Sungwoo Kim (1): Bluetooth: L2CAP: Fix u8 overflow Szymon Heidrich (1): usb: gadget: uvc: Prevent buffer overflow in setup handler Tiezhu Yang (1): selftests: net: Use "grep -E" instead of "egrep" Tony Nguyen (1): igb: Initialize mailbox message for VF reset

2 years, 11 months

1
1
0 0

Linux 5.15.85

by Greg Kroah-Hartman

I'm announcing the release of the 5.15.85 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 drivers/hid/hid-uclogic-core.c | 1 drivers/net/ethernet/intel/igb/igb_main.c | 2 drivers/net/loopback.c | 2 drivers/usb/dwc3/dwc3-pci.c | 2 drivers/usb/gadget/function/f_uvc.c | 5 + drivers/usb/host/xhci-pci.c | 4 + drivers/usb/serial/cp210x.c | 2 drivers/usb/serial/f81232.c | 12 ++-- drivers/usb/serial/f81534.c | 12 ++-- drivers/usb/serial/option.c | 3 + fs/udf/inode.c | 76 +++++++++++++----------------- fs/udf/truncate.c | 48 +++++------------- net/bluetooth/l2cap_core.c | 3 - tools/testing/selftests/net/toeplitz.sh | 2 15 files changed, 82 insertions(+), 94 deletions(-) Bruno Thomsen (1): USB: serial: cp210x: add Kamstrup RF sniffer PIDs Duke Xin (1): USB: serial: option: add Quectel EM05-G modem Greg Kroah-Hartman (1): Linux 5.15.85 Jan Kara (4): udf: Discard preallocation before extending file with a hole udf: Fix preallocation discarding at indirect extent boundary udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size udf: Fix extending file within last block Johan Hovold (2): USB: serial: f81232: fix division by zero on line-speed change USB: serial: f81534: fix division by zero on line-speed change José Expósito (1): HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk Rasmus Villemoes (1): net: loopback: use NET_NAME_PREDICTABLE for name_assign_type Reka Norman (1): xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N Shruthi Sanil (1): usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system for Raptor Lake Sungwoo Kim (1): Bluetooth: L2CAP: Fix u8 overflow Szymon Heidrich (1): usb: gadget: uvc: Prevent buffer overflow in setup handler Tiezhu Yang (1): selftests: net: Use "grep -E" instead of "egrep" Tony Nguyen (1): igb: Initialize mailbox message for VF reset

2 years, 11 months

1
1
0 0

Linux 5.10.161

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.161 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 drivers/hid/hid-ids.h | 2 drivers/hid/hid-ite.c | 26 +++++++++- drivers/hid/hid-uclogic-core.c | 1 drivers/net/ethernet/intel/igb/igb_main.c | 2 drivers/net/loopback.c | 2 drivers/usb/gadget/function/f_uvc.c | 5 + drivers/usb/host/xhci-pci.c | 4 + drivers/usb/serial/cp210x.c | 2 drivers/usb/serial/f81232.c | 12 ++-- drivers/usb/serial/f81534.c | 12 ++-- drivers/usb/serial/option.c | 3 + fs/udf/inode.c | 76 +++++++++++++----------------- fs/udf/truncate.c | 48 +++++------------- net/bluetooth/l2cap_core.c | 3 - 15 files changed, 106 insertions(+), 94 deletions(-) Bruno Thomsen (1): USB: serial: cp210x: add Kamstrup RF sniffer PIDs Duke Xin (1): USB: serial: option: add Quectel EM05-G modem Greg Kroah-Hartman (1): Linux 5.10.161 Hans de Goede (3): HID: ite: Add support for Acer S1002 keyboard-dock HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 Jan Kara (4): udf: Discard preallocation before extending file with a hole udf: Fix preallocation discarding at indirect extent boundary udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size udf: Fix extending file within last block Johan Hovold (2): USB: serial: f81232: fix division by zero on line-speed change USB: serial: f81534: fix division by zero on line-speed change José Expósito (1): HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk Rasmus Villemoes (1): net: loopback: use NET_NAME_PREDICTABLE for name_assign_type Reka Norman (1): xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N Sungwoo Kim (1): Bluetooth: L2CAP: Fix u8 overflow Szymon Heidrich (1): usb: gadget: uvc: Prevent buffer overflow in setup handler Tony Nguyen (1): igb: Initialize mailbox message for VF reset

2 years, 11 months

1
1
0 0

[PATCH v2] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

by Krzysztof Kozlowski

Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer. Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> --- Changes since v1: 1. Rename the function (Jiri) --- drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c index b487823f0e61..49b9ffeae676 100644 --- a/drivers/tty/serial/qcom_geni_serial.c +++ b/drivers/tty/serial/qcom_geni_serial.c @@ -864,9 +864,10 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev) return IRQ_HANDLED; } -static void get_tx_fifo_size(struct qcom_geni_serial_port *port) +static int setup_fifos(struct qcom_geni_serial_port *port) { struct uart_port *uport; + u32 old_rx_fifo_depth = port->rx_fifo_depth; uport = &port->uport; port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se); @@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port) port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se); uport->fifosize = (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE; + + if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) { + port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo, + port->rx_fifo_depth * sizeof(u32), + GFP_KERNEL); + if (!port->rx_fifo) + return -ENOMEM; + } + + return 0; } @@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport) u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT; u32 proto; u32 pin_swap; + int ret; proto = geni_se_read_proto(&port->se); if (proto != GENI_SE_UART) { @@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport) qcom_geni_serial_stop_rx(uport); - get_tx_fifo_size(port); + ret = setup_fifos(port); + if (ret) + return ret; writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT); -- 2.34.1

2 years, 11 months

1
0
0 0

[PATCH 6.0 00/28] 6.0.15-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.0.15 release. There are 28 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 21 Dec 2022 18:29:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.15-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.0.15-rc1 Rasmus Villemoes <linux(a)rasmusvillemoes.dk> net: loopback: use NET_NAME_PREDICTABLE for name_assign_type Tiezhu Yang <yangtiezhu(a)loongson.cn> selftests: net: Use "grep -E" instead of "egrep" Sungwoo Kim <iam(a)sung-woo.kim> Bluetooth: L2CAP: Fix u8 overflow Ferry Toth <ftoth(a)exalondelft.nl> usb: ulpi: defer ulpi_register on ulpi_read_id timeout Nikolaus Voss <nikolaus.voss(a)haag-streit.com> KEYS: encrypted: fix key instantiation with user-provided data Shruthi Sanil <shruthi.sanil(a)intel.com> usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system for Raptor Lake Heikki Krogerus <heikki.krogerus(a)linux.intel.com> usb: typec: ucsi: Resume in separate work Tony Nguyen <anthony.l.nguyen(a)intel.com> igb: Initialize mailbox message for VF reset Reka Norman <rekanorman(a)chromium.org> xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N Andy Chi <andy.chi(a)canonical.com> ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook Johan Hovold <johan(a)kernel.org> USB: serial: f81534: fix division by zero on line-speed change Johan Hovold <johan(a)kernel.org> USB: serial: f81232: fix division by zero on line-speed change Bruno Thomsen <bruno.thomsen(a)gmail.com> USB: serial: cp210x: add Kamstrup RF sniffer PIDs Duke Xin <duke_xinanwen(a)163.com> USB: serial: option: add Quectel EM05-G modem Szymon Heidrich <szymon.heidrich(a)gmail.com> usb: gadget: uvc: Prevent buffer overflow in setup handler Jan Kara <jack(a)suse.cz> udf: Fix extending file within last block Jan Kara <jack(a)suse.cz> udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size Jan Kara <jack(a)suse.cz> udf: Fix preallocation discarding at indirect extent boundary Jan Kara <jack(a)suse.cz> udf: Discard preallocation before extending file with a hole Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Add kprobe_multi kmod attach api tests Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Add kprobe_multi check to module attach test Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Add bpf_testmod_fentry_* functions Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Add load_kallsyms_refresh function Jiri Olsa <jolsa(a)kernel.org> bpf: Take module reference on kprobe_multi link Jiri Olsa <jolsa(a)kernel.org> bpf: Rename __bpf_kprobe_multi_cookie_cmp to bpf_kprobe_multi_addrs_cmp Jiri Olsa <jolsa(a)kernel.org> ftrace: Add support to resolve module symbols in ftrace_lookup_symbols Jiri Olsa <jolsa(a)kernel.org> kallsyms: Make module_kallsyms_on_each_symbol generally available John Thomson <git(a)johnthomson.fastmail.com.au> PCI: mt7621: Add sentinel to quirks table ------------- Diffstat: Documentation/security/keys/trusted-encrypted.rst | 3 +- Makefile | 4 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- drivers/net/loopback.c | 2 +- drivers/pci/controller/pcie-mt7621.c | 3 +- drivers/usb/common/ulpi.c | 2 +- drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/gadget/function/f_uvc.c | 5 +- drivers/usb/host/xhci-pci.c | 4 +- drivers/usb/serial/cp210x.c | 2 + drivers/usb/serial/f81232.c | 12 +-- drivers/usb/serial/f81534.c | 12 +-- drivers/usb/serial/option.c | 3 + drivers/usb/typec/ucsi/ucsi.c | 17 +++- drivers/usb/typec/ucsi/ucsi.h | 1 + fs/udf/inode.c | 76 ++++++++--------- fs/udf/truncate.c | 48 ++++------- include/linux/module.h | 9 ++ kernel/module/kallsyms.c | 2 - kernel/trace/bpf_trace.c | 98 +++++++++++++++++++++- kernel/trace/ftrace.c | 16 ++-- net/bluetooth/l2cap_core.c | 3 +- security/keys/encrypted-keys/encrypted.c | 6 +- sound/pci/hda/patch_realtek.c | 2 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 24 ++++++ .../bpf/prog_tests/kprobe_multi_testmod_test.c | 89 ++++++++++++++++++++ .../selftests/bpf/prog_tests/module_attach.c | 7 ++ tools/testing/selftests/bpf/progs/kprobe_multi.c | 50 +++++++++++ .../selftests/bpf/progs/test_module_attach.c | 6 ++ tools/testing/selftests/bpf/trace_helpers.c | 20 +++-- tools/testing/selftests/bpf/trace_helpers.h | 2 + tools/testing/selftests/net/toeplitz.sh | 2 +- 32 files changed, 412 insertions(+), 122 deletions(-)

2 years, 11 months

10
39
0 0

[PATCH] security: Restore passing final prot to ima_file_mmap()

by Roberto Sassu

From: Roberto Sassu <roberto.sassu(a)huawei.com> Commit 98de59bfe4b2f ("take calculation of final prot in security_mmap_file() into a helper") moved the code to update prot with the actual protection flags to be granted to the requestor by the kernel to a helper called mmap_prot(). However, the patch didn't update the argument passed to ima_file_mmap(), making it receive the requested prot instead of the final computed prot. A possible consequence is that files mmapped as executable might not be measured/appraised if PROT_EXEC is not requested but subsequently added in the final prot. Replace prot with mmap_prot(prot) as the second argument of ima_file_mmap() to restore the original behavior. Cc: stable(a)vger.kernel.org Fixes: 98de59bfe4b2 ("take calculation of final prot in security_mmap_file() into a helper") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- security/security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/security.c b/security/security.c index d1571900a8c7..0d2359d588a1 100644 --- a/security/security.c +++ b/security/security.c @@ -1666,7 +1666,7 @@ int security_mmap_file(struct file *file, unsigned long prot, mmap_prot(file, prot), flags); if (ret) return ret; - return ima_file_mmap(file, prot); + return ima_file_mmap(file, mmap_prot(file, prot)); } int security_mmap_addr(unsigned long addr) -- 2.25.1

2 years, 11 months

1
0
0 0

[PATCH AUTOSEL 6.1 01/16] crypto: hisilicon/hpre - fix resource leak in remove process

by Sasha Levin

From: Zhiqi Song <songzhiqi1(a)huawei.com> [ Upstream commit 45e6319bd5f2154d8b8c9f1eaa4ac030ba0d330c ] In hpre_remove(), when the disable operation of qm sriov failed, the following logic should continue to be executed to release the remaining resources that have been allocated, instead of returning directly, otherwise there will be resource leakage. Signed-off-by: Zhiqi Song <songzhiqi1(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/crypto/hisilicon/hpre/hpre_main.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c index 471e5ca720f5..baf1faec7046 100644 --- a/drivers/crypto/hisilicon/hpre/hpre_main.c +++ b/drivers/crypto/hisilicon/hpre/hpre_main.c @@ -1437,18 +1437,12 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id) static void hpre_remove(struct pci_dev *pdev) { struct hisi_qm *qm = pci_get_drvdata(pdev); - int ret; hisi_qm_pm_uninit(qm); hisi_qm_wait_task_finish(qm, &hpre_devices); hisi_qm_alg_unregister(qm, &hpre_devices); - if (qm->fun_type == QM_HW_PF && qm->vfs_num) { - ret = hisi_qm_sriov_disable(pdev, true); - if (ret) { - pci_err(pdev, "Disable SRIOV fail!\n"); - return; - } - } + if (qm->fun_type == QM_HW_PF && qm->vfs_num) + hisi_qm_sriov_disable(pdev, true); hpre_debugfs_exit(qm); hisi_qm_stop(qm, QM_NORMAL); -- 2.35.1

2 years, 11 months

2
17
0 0

Re: kernel BUG in ext4_free_blocks (2)

by syzbot

This bug is marked as fixed by commit: ext4: block range must be validated before use in ext4_mb_clear_bb() But I can't find it in any tested tree for more than 90 days. Is it a correct commit? Please update it by replying: #syz fix: exact-commit-title Until then the bug is still considered open and new crashes with the same signature are ignored.

2 years, 11 months

4
10
0 0

[PATCH] tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

by Krzysztof Kozlowski

Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer. Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c index b487823f0e61..1568fe69e3e8 100644 --- a/drivers/tty/serial/qcom_geni_serial.c +++ b/drivers/tty/serial/qcom_geni_serial.c @@ -864,9 +864,10 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev) return IRQ_HANDLED; } -static void get_tx_fifo_size(struct qcom_geni_serial_port *port) +static int get_tx_fifo_size(struct qcom_geni_serial_port *port) { struct uart_port *uport; + u32 old_rx_fifo_depth = port->rx_fifo_depth; uport = &port->uport; port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se); @@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port) port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se); uport->fifosize = (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE; + + if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) { + port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo, + port->rx_fifo_depth * sizeof(u32), + GFP_KERNEL); + if (!port->rx_fifo) + return -ENOMEM; + } + + return 0; } @@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport) u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT; u32 proto; u32 pin_swap; + int ret; proto = geni_se_read_proto(&port->se); if (proto != GENI_SE_UART) { @@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport) qcom_geni_serial_stop_rx(uport); - get_tx_fifo_size(port); + ret = get_tx_fifo_size(port); + if (ret) + return ret; writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT); -- 2.34.1

2 years, 11 months

2
2
0 0

[PATCH] vhost_vdpa: fix the compile issue in commit 881ac7d2314f

by Cindy Lu

The input of vhost_vdpa_iotlb_unmap() was changed in 881ac7d2314f, But some function was not changed while calling this function. Add this change Cc: stable(a)vger.kernel.org Fixes: 881ac7d2314f ("vhost_vdpa: fix the crash in unmap a large memory") Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Cindy Lu <lulu(a)redhat.com> --- drivers/vhost/vdpa.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index 46ce35bea705..ec32f785dfde 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -66,8 +66,8 @@ static DEFINE_IDA(vhost_vdpa_ida); static dev_t vhost_vdpa_major; static void vhost_vdpa_iotlb_unmap(struct vhost_vdpa *v, - struct vhost_iotlb *iotlb, - u64 start, u64 last); + struct vhost_iotlb *iotlb, u64 start, + u64 last, u32 asid); static inline u32 iotlb_to_asid(struct vhost_iotlb *iotlb) { @@ -139,7 +139,7 @@ static int vhost_vdpa_remove_as(struct vhost_vdpa *v, u32 asid) return -EINVAL; hlist_del(&as->hash_link); - vhost_vdpa_iotlb_unmap(v, &as->iotlb, 0ULL, 0ULL - 1); + vhost_vdpa_iotlb_unmap(v, &as->iotlb, 0ULL, 0ULL - 1, asid); kfree(as); return 0; -- 2.34.3

2 years, 11 months

3
5
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2022