Projects
openEuler:20.03:LTS:SP1
kernel
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
Expand all
Collapse all
Changes of Revision 345
View file
_service:tar_scm_kernel_repo:kernel.spec
Changed
@@ -12,7 +12,7 @@ %global KernelVer %{version}-%{release}.%{_target_cpu} -%global hulkrelease 2312.6.0 +%global hulkrelease 2401.1.0 %define with_patch 0 @@ -32,7 +32,7 @@ Name: kernel Version: 4.19.90 -Release: %{hulkrelease}.0232 +Release: %{hulkrelease}.0233 Summary: Linux Kernel License: GPLv2 URL: http://www.kernel.org/ @@ -809,6 +809,28 @@ %changelog +* Tue Jan 02 2024 Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2401.1.0.0233 +- !3660 atm: Fix Use-After-Free in do_vcc_ioctl +- !3687 Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg +- Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg +- !3672 smb: client: fix potential OOB in smb2_dump_detail() +- !3671 smb: client: fix OOB in smbCalcSize() +- !3627 jbd2: fix soft lockup in journal_finish_inode_data_buffers() +- !3189 fs: don't audit the capability check in simple_xattr_list() +- smb: client: fix potential OOB in smb2_dump_detail() +- smb: client: fix OOB in smbCalcSize() +- !3555 net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() +- atm: Fix Use-After-Free in do_vcc_ioctl +- !3592 CVE-2023-35827 patchset +- !3449 Fix data-races around +- jbd2: fix soft lockup in journal_finish_inode_data_buffers() +- ravb: Fix races between ravb_tx_timeout_work() and net related ops +- ravb: Fix use-after-free issue in ravb_tx_timeout_work() +- net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() +- ip: Fix data-races around sysctl_ip_no_pmtu_disc. +- ip: Fix data-races around sysctl_ip_fwd_update_priority. +- fs: don't audit the capability check in simple_xattr_list() + * Wed Dec 27 2023 Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2312.6.0.0232 - !3607 Fix CVE-2023-6546 - !3606 perf/core: Fix CVE-2023-6931
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
Changed
@@ -7429,14 +7429,15 @@ static int __mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp) { - bool usp = init_net.ipv4.sysctl_ip_fwd_update_priority; char rgcr_pl[MLXSW_REG_RGCR_LEN]; u64 max_rifs; + bool usp; int err; if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, MAX_RIFS)) return -EIO; max_rifs = MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS); + usp = READ_ONCE(init_net.ipv4.sysctl_ip_fwd_update_priority); mlxsw_reg_rgcr_pack(rgcr_pl, true, true); mlxsw_reg_rgcr_max_router_interfaces_set(rgcr_pl, max_rifs);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/net/ethernet/renesas/ravb_main.c
Changed
@@ -1446,6 +1446,12 @@ work); struct net_device *ndev = priv->ndev; + if (!rtnl_trylock()) { + usleep_range(1000, 2000); + schedule_work(&priv->work); + return; + } + netif_tx_stop_all_queues(ndev); /* Stop PTP Clock driver */ @@ -1467,6 +1473,8 @@ ravb_ptp_init(ndev, priv->pdev); netif_tx_start_all_queues(ndev); + + rtnl_unlock(); } /* Packet transmit function for Ethernet AVB */ @@ -1683,6 +1691,8 @@ of_phy_deregister_fixed_link(np); } + cancel_work_sync(&priv->work); + if (priv->chip_id != RCAR_GEN2) { free_irq(priv->tx_irqs[RAVB_NC], ndev); free_irq(priv->rx_irqs[RAVB_NC], ndev);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/fs/cifs/misc.c
Changed
@@ -344,6 +344,10 @@ cifs_dbg(VFS, "Length less than smb header size\n"); } return -EIO; + } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { + cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", + __func__, smb->WordCount); + return -EIO; } /* otherwise, there is enough to get to the BCC */
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/fs/cifs/smb2misc.c
Changed
@@ -165,6 +165,21 @@ } mid = le64_to_cpu(shdr->MessageId); + if (check_smb2_hdr(shdr, mid)) + return 1; + + if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { + cifs_dbg(VFS, "Invalid structure size %u\n", + le16_to_cpu(shdr->StructureSize)); + return 1; + } + + command = le16_to_cpu(shdr->Command); + if (command >= NUMBER_OF_SMB2_COMMANDS) { + cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); + return 1; + } + if (len < pdu_size) { if ((len >= hdr_size) && (shdr->Status != 0)) { @@ -185,21 +200,6 @@ return 1; } - if (check_smb2_hdr(shdr, mid)) - return 1; - - if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { - cifs_dbg(VFS, "Illegal structure size %u\n", - le16_to_cpu(shdr->StructureSize)); - return 1; - } - - command = le16_to_cpu(shdr->Command); - if (command >= NUMBER_OF_SMB2_COMMANDS) { - cifs_dbg(VFS, "Illegal SMB2 command %d\n", command); - return 1; - } - if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) { if (command != SMB2_OPLOCK_BREAK_HE && (shdr->Status == 0 || pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2)) {
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/fs/cifs/smb2ops.c
Changed
@@ -248,8 +248,10 @@ cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, shdr->ProcessId); - cifs_dbg(VFS, "smb buf %p len %u\n", buf, - server->ops->calc_smb_size(buf, server)); + if (!server->ops->check_message(buf, server->total_read, server)) { + cifs_dbg(VFS, "smb buf %p len %u\n", buf, + server->ops->calc_smb_size(buf, server)); + } #endif }
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/fs/jbd2/commit.c
Changed
@@ -274,6 +274,7 @@ dirty_end); if (!ret) ret = err; + cond_resched(); spin_lock(&journal->j_list_lock); jinode->i_flags &= ~JI_COMMIT_RUNNING; smp_mb();
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/fs/xattr.c
Changed
@@ -1012,7 +1012,7 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, char *buffer, size_t size) { - bool trusted = capable(CAP_SYS_ADMIN); + bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); struct simple_xattr *xattr; ssize_t remaining_size = size; int err = 0;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/8021q/vlan_core.c
Changed
@@ -380,6 +380,8 @@ return 0; list_for_each_entry(vid_info, &vlan_info->vid_list, list) { + if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) + continue; err = vlan_vid_add(dev, vid_info->proto, vid_info->vid); if (err) goto unwind; @@ -390,6 +392,8 @@ list_for_each_entry_continue_reverse(vid_info, &vlan_info->vid_list, list) { + if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) + continue; vlan_vid_del(dev, vid_info->proto, vid_info->vid); } @@ -409,8 +413,11 @@ if (!vlan_info) return; - list_for_each_entry(vid_info, &vlan_info->vid_list, list) + list_for_each_entry(vid_info, &vlan_info->vid_list, list) { + if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) + continue; vlan_vid_del(dev, vid_info->proto, vid_info->vid); + } } EXPORT_SYMBOL(vlan_vids_del_by_dev);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/atm/ioctl.c
Changed
@@ -71,14 +71,17 @@ case SIOCINQ: { struct sk_buff *skb; + int amount; if (sock->state != SS_CONNECTED) { error = -EINVAL; goto done; } + spin_lock_irq(&sk->sk_receive_queue.lock); skb = skb_peek(&sk->sk_receive_queue); - error = put_user(skb ? skb->len : 0, - (int __user *)argp) ? -EFAULT : 0; + amount = skb ? skb->len : 0; + spin_unlock_irq(&sk->sk_receive_queue.lock); + error = put_user(amount, (int __user *)argp) ? -EFAULT : 0; goto done; } case SIOCGSTAMP: /* borrowed from IP */
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/bluetooth/af_bluetooth.c
Changed
@@ -263,11 +263,14 @@ if (flags & MSG_OOB) return -EOPNOTSUPP; + lock_sock(sk); + skb = skb_recv_datagram(sk, flags, noblock, &err); if (!skb) { if (sk->sk_shutdown & RCV_SHUTDOWN) - return 0; + err = 0; + release_sock(sk); return err; } @@ -290,6 +293,8 @@ skb_free_datagram(sk, skb); + release_sock(sk); + if (flags & MSG_TRUNC) copied = skblen;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/ipv4/af_inet.c
Changed
@@ -337,7 +337,7 @@ inet->hdrincl = 1; } - if (net->ipv4.sysctl_ip_no_pmtu_disc) + if (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) inet->pmtudisc = IP_PMTUDISC_DONT; else inet->pmtudisc = IP_PMTUDISC_WANT;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/ipv4/icmp.c
Changed
@@ -898,7 +898,7 @@ * values please see * Documentation/networking/ip-sysctl.txt */ - switch (net->ipv4.sysctl_ip_no_pmtu_disc) { + switch (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) { default: net_dbg_ratelimited("%pI4: fragmentation needed and DF set\n", &iph->daddr);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/ipv4/ip_forward.c
Changed
@@ -144,7 +144,7 @@ !skb_sec_path(skb)) ip_rt_send_redirect(skb); - if (net->ipv4.sysctl_ip_fwd_update_priority) + if (READ_ONCE(net->ipv4.sysctl_ip_fwd_update_priority)) skb->priority = rt_tos2priority(iph->tos); return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/ipv6/af_inet6.c
Changed
@@ -231,7 +231,7 @@ inet->mc_list = NULL; inet->rcv_tos = 0; - if (net->ipv4.sysctl_ip_no_pmtu_disc) + if (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) inet->pmtudisc = IP_PMTUDISC_DONT; else inet->pmtudisc = IP_PMTUDISC_WANT;
View file
_service:tar_scm_kernel_repo:SOURCE
Changed
@@ -1 +1 @@ -4.19.90-2312.6.0 +4.19.90-2401.1.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.