Projects
openEuler:20.03:LTS:SP1
kernel
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
Expand all
Collapse all
Changes of Revision 348
View file
_service:tar_scm_kernel_repo:kernel.spec
Changed
@@ -12,7 +12,7 @@ %global KernelVer %{version}-%{release}.%{_target_cpu} -%global hulkrelease 2401.4.0 +%global hulkrelease 2401.5.0 %define with_patch 0 @@ -32,7 +32,7 @@ Name: kernel Version: 4.19.90 -Release: %{hulkrelease}.0235 +Release: %{hulkrelease}.0236 Summary: Linux Kernel License: GPLv2 URL: http://www.kernel.org/ @@ -809,6 +809,27 @@ %changelog +* Tue Jan 23 2024 Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2401.5.0.0236 +- !4101 netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() +- !2954 spi: phytium: fix phytium_spi_irq panic on boot +- netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() +- !4067 fix CVE-2022-48619 +- !4080 rtnetlink: Reject negative ifindexes in RTM_NEWLINK +- rtnetlink: Reject negative ifindexes in RTM_NEWLINK +- Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK" +- !4065 smb: client: fix OOB in receive_encrypted_standard() +- !4021 netfilter: nf_tables: Reject tables of unsupported family +- Input: add bounds checking to input_set_capability() +- smb: client: fix OOB in receive_encrypted_standard() +- !4039 crypto: hisilicon/qm: fix several issues +- !4025 crypto: hisilicon - replace 'smp_processor_id' with the raw version of the macro +- !3980 vhost: use kzalloc() instead of kmalloc() followed by memset() +- crypto: hisilicon/qm: fix several issues +- crypto: hisilicon - replace 'smp_processor_id' with the raw version of the macro +- netfilter: nf_tables: Reject tables of unsupported family +- vhost: use kzalloc() instead of kmalloc() followed by memset() +- spi: phytium: fix phytium_spi_irq panic on boot + * Tue Jan 16 2024 Zhang Changzhong <zhangchangzhong@huawei.com> - 4.19.90-2401.4.0.0235 - !4006 crypto: hisilicon/sec2: fix memory use-after-free issue - crypto: hisilicon/sec2: fix memory use-after-free issue
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/crypto/hisilicon/hpre/hpre_main.c
Changed
@@ -226,7 +226,7 @@ struct hisi_qp *hpre_create_qp(void) { - int node = cpu_to_node(smp_processor_id()); + int node = cpu_to_node(raw_smp_processor_id()); struct hisi_qp *qp = NULL; int ret;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/crypto/hisilicon/qm.c
Changed
@@ -277,8 +277,7 @@ { .int_msk = BIT(9), .msg = "qm_sq_vf_invalid" }, { .int_msk = BIT(10), .msg = "qm_db_timeout" }, { .int_msk = BIT(11), .msg = "qm_of_fifo_of" }, - { .int_msk = BIT(12), .msg = "qm_db_random_invalid" }, - { /* sentinel */ } + { .int_msk = BIT(12), .msg = "qm_db_random_invalid" } }; static const char * const qm_db_timeout[] = { @@ -774,10 +773,11 @@ static irqreturn_t qm_abnormal_irq(int irq, void *data) { - const struct hisi_qm_hw_error *err = qm_hw_error; + const struct hisi_qm_hw_error *err; struct hisi_qm *qm = data; struct device *dev = &qm->pdev->dev; u32 error_status, tmp; + int i; atomic64_inc(&qm->debug.dfx.abnormal_irq_cnt); if (qm->abnormal_fix) { @@ -789,12 +789,13 @@ tmp = readl(qm->io_base + QM_ABNORMAL_INT_STATUS); error_status = qm->msi_mask & tmp; - while (err->msg) { - if (err->int_msk & error_status) - dev_err(dev, "%s [error status=0x%x] found\n", - err->msg, err->int_msk); + for (i = 0; i < ARRAY_SIZE(qm_hw_error); i++) { + err = &qm_hw_error[i]; + if (!(err->int_msk & error_status)) + continue; - err++; + dev_err(dev, "%s [error status=0x%x] found\n", + err->msg, err->int_msk); } /* clear err sts */ @@ -2639,12 +2640,23 @@ static int qm_clear_device(struct hisi_qm *qm) { + acpi_handle handle = ACPI_HANDLE(&qm->pdev->dev); u32 val; int ret; if (qm->fun_type == QM_HW_VF) return 0; + if (!handle) { + pci_warn(qm->pdev, "Device does not support reset, return.\n"); + return 0; + } + + if (!acpi_has_method(handle, qm->err_ini.err_info.acpi_rst)) { + pci_warn(qm->pdev, "BIOS has no reset method, return.\n"); + return 0; + } + /* OOO register set and check */ writel(MASTER_GLOBAL_CTRL_SHUTDOWN, qm->io_base + MASTER_GLOBAL_CTRL);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/crypto/hisilicon/rde/rde_main.c
Changed
@@ -218,7 +218,7 @@ struct hisi_qp *rde_create_qp(void) { - int node = cpu_to_node(smp_processor_id()); + int node = cpu_to_node(raw_smp_processor_id()); struct hisi_qp *qp; int ret;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/crypto/hisilicon/sec2/sec_main.c
Changed
@@ -189,7 +189,7 @@ struct hisi_qp **sec_create_qps(void) { - int node = cpu_to_node(smp_processor_id()); + int node = cpu_to_node(raw_smp_processor_id()); u32 ctx_num = ctx_q_num; struct hisi_qp **qps; int ret;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/crypto/hisilicon/zip/zip_main.c
Changed
@@ -268,7 +268,7 @@ int zip_create_qps(struct hisi_qp **qps, int ctx_num) { - int node = cpu_to_node(smp_processor_id()); + int node = cpu_to_node(raw_smp_processor_id()); return hisi_qm_alloc_qps_node(node, &zip_devices, qps, ctx_num, 0);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/input/input.c
Changed
@@ -50,6 +50,17 @@ static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 }; +static const unsigned int input_max_code[EV_CNT] = { + [EV_KEY] = KEY_MAX, + [EV_REL] = REL_MAX, + [EV_ABS] = ABS_MAX, + [EV_MSC] = MSC_MAX, + [EV_SW] = SW_MAX, + [EV_LED] = LED_MAX, + [EV_SND] = SND_MAX, + [EV_FF] = FF_MAX, +}; + static inline int is_event_supported(unsigned int code, unsigned long *bm, unsigned int max) { @@ -1915,6 +1926,14 @@ */ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code) { + if (type < EV_CNT && input_max_code[type] && + code > input_max_code[type]) { + pr_err("%s: invalid code %u for type %u\n", __func__, code, + type); + dump_stack(); + return; + } + switch (type) { case EV_KEY: __set_bit(code, dev->keybit);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/spi/spi-phytium.c
Changed
@@ -458,13 +458,6 @@ fts->master = master; snprintf(fts->name, sizeof(fts->name), "phytium_spi%d", fts->bus_num); - ret = request_irq(fts->irq, phytium_spi_irq, - IRQF_SHARED, fts->name, master); - if (ret < 0) { - dev_err(dev, "can not get IRQ\n"); - goto err_free_master; - } - master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_LOOP; master->bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16); master->bus_num = fts->bus_num; @@ -483,6 +476,14 @@ spi_hw_init(dev, fts); spi_master_set_devdata(master, fts); + + ret = request_irq(fts->irq, phytium_spi_irq, + IRQF_SHARED, fts->name, master); + if (ret < 0) { + dev_err(dev, "can not get IRQ\n"); + goto err_free_master; + } + ret = devm_spi_register_master(dev, master); if (ret) { dev_err(&master->dev, "problem registering spi master\n");
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/drivers/vhost/vhost.c
Changed
@@ -2484,12 +2484,11 @@ /* Create a new message. */ struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type) { - struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL); + /* Make sure all padding within the structure is initialized. */ + struct vhost_msg_node *node = kzalloc(sizeof(*node), GFP_KERNEL); if (!node) return NULL; - /* Make sure all padding within the structure is initialized. */ - memset(&node->msg, 0, sizeof node->msg); node->vq = vq; node->msg.type = type; return node;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/fs/cifs/smb2ops.c
Changed
@@ -3185,6 +3185,7 @@ struct smb2_sync_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -3213,14 +3214,15 @@ next_is_large = server->large_buf; one_more: shdr = (struct smb2_sync_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -3244,8 +3246,8 @@ else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer;
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/core/rtnetlink.c
Changed
@@ -2702,10 +2702,7 @@ ifm = nlmsg_data(nlh); if (ifm->ifi_index > 0) dev = __dev_get_by_index(net, ifm->ifi_index); - else if (ifm->ifi_index < 0) { - NL_SET_ERR_MSG(extack, "ifindex can't be negative"); - return -EINVAL; - } else if (tb[IFLA_IFNAME]) + else if (tb[IFLA_IFNAME]) dev = __dev_get_by_name(net, ifname); else goto errout; @@ -2973,9 +2970,12 @@ ifname[0] = '\0'; ifm = nlmsg_data(nlh); - if (ifm->ifi_index > 0) + if (ifm->ifi_index > 0) { dev = __dev_get_by_index(net, ifm->ifi_index); - else { + } else if (ifm->ifi_index < 0) { + NL_SET_ERR_MSG(extack, "ifindex can't be negative"); + return -EINVAL; + } else { if (ifname[0]) dev = __dev_get_by_name(net, ifname); else
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/netfilter/nf_tables_api.c
Changed
@@ -853,6 +853,30 @@ return strcmp(chain->name, name); } +static bool nft_supported_family(u8 family) +{ + return false +#ifdef CONFIG_NF_TABLES_INET + || family == NFPROTO_INET +#endif +#ifdef CONFIG_NF_TABLES_IPV4 + || family == NFPROTO_IPV4 +#endif +#ifdef CONFIG_NF_TABLES_ARP + || family == NFPROTO_ARP +#endif +#ifdef CONFIG_NF_TABLES_NETDEV + || family == NFPROTO_NETDEV +#endif +#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) + || family == NFPROTO_BRIDGE +#endif +#ifdef CONFIG_NF_TABLES_IPV6 + || family == NFPROTO_IPV6 +#endif + ; +} + static int nf_tables_newtable(struct net *net, struct sock *nlsk, struct sk_buff *skb, const struct nlmsghdr *nlh, const struct nlattr * const nla[], @@ -867,6 +891,9 @@ struct nft_ctx ctx; int err; + if (!nft_supported_family(family)) + return -EOPNOTSUPP; + lockdep_assert_held(&net->nft.commit_mutex); attr = nla[NFTA_TABLE_NAME]; table = nft_table_lookup(net, attr, family, genmask);
View file
_service:recompress:tar_scm_kernel_repo:kernel.tar.gz/net/netfilter/nft_byteorder.c
Changed
@@ -41,19 +41,20 @@ switch (priv->size) { case 8: { + u64 *dst64 = (void *)dst; u64 src64; switch (priv->op) { case NFT_BYTEORDER_NTOH: for (i = 0; i < priv->len / 8; i++) { src64 = get_unaligned((u64 *)&src[i]); - put_unaligned_be64(src64, &dst[i]); + put_unaligned_be64(src64, &dst64[i]); } break; case NFT_BYTEORDER_HTON: for (i = 0; i < priv->len / 8; i++) { src64 = get_unaligned_be64(&src[i]); - put_unaligned(src64, (u64 *)&dst[i]); + put_unaligned(src64, (u64 *)&dst64[i]); } break; }
View file
_service:tar_scm_kernel_repo:SOURCE
Changed
@@ -1 +1 @@ -4.19.90-2401.4.0 +4.19.90-2401.5.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.