Unverified Commit 18e32b66 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!415 mainline bugfix backport 

Merge Pull Request from: @LiuYongQiang0816 
 
|标题| 分析结果|
|--------| ------|
|crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() |	在进行读取之前需要检查digest_info大小是否足够 |
|crypto: algif_skcipher - EBUSY on aio should be an error				 |	正确返回错误 |
|crypto: algif_skcipher - Use chunksize instead of blocksize				 |	修复CTR场景下参数错误的问题 |
|ipmi: use %*ph to print small buffer									 |	修复可能buffer溢出的问题 |
|component: do not dereference opaque pointer in debugfs					 |	match->compare[i].data不一定是struct device* 指针类型，这里使用dev_name(data)打印设备名，有可能造成空指针访问。改使用dev_name(component->dev)来打印设备名称|
|drivers/iommu: Export core IOMMU API symbols to permit modular drivers	 |	导出构建IOMMU驱动时所需要的iommu core api。此补丁能够解决iommu driver编译为模块时符号缺失的问题 |
|drivers/iommu: Allow IOMMU bus ops to be unregistered					 |	在iommu类KO卸载的情况下，ops指针非法，有可能触发访问非法地址。修复方式：让bus_set_iommu（）接受一个NULL值ops参数来让给定bus类型ops重置 |
|of: unittest: Add of_node_put() before return							 |	修复driver/of/unittest.c中异常返回路径上的内存泄漏问题 |
|of: resolver: Add of_node_put() before return and break					 |	修复从for_each_child_of_node循环中break/return时没有put node而导致内存泄漏的问题 |
|iommu: Properly export iommu_group_get_for_dev()						 |	修复一个iommu core api未使用EXPORT_SYMBOL_GPL导出的问题。是drivers/iommu: Export core IOMMU API symbols to permit modular drivers的后置补丁|
|evm: Check also if *tfm is an error pointer in init_desc()				 |	修补一种在多线程场景下可能的竞争状态|
|evm: Fix a small race in init_desc()									 |	在极端条件下，即便使用了 IS_ERR_OR_NULL() 也会出现竞争状态：其内部会针对 error pointer 和 NULL 做两次判断，而竞争状态可能出现在两次判断之间|
|selinux: reorder hooks to make runtime disable less broken				 |	由于该补丁（v5.6）于 LSM Blob 机制（v5.1）之后合入，一些 hooks 在 4.19 上的实现逻辑与该补丁合入时的有变化，因此它们的位置需要进一步调整|				
 
 
Link:https://gitee.com/openeuler/kernel/pulls/415

 

Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents d755712e 87d41806

crypto/algif_skcipher.c

+2 −2
Original line number Diff line number Diff line
@@ -60,7 +60,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, 
	struct alg_sock *pask = alg_sk(psk);

	struct af_alg_ctx *ctx = ask->private;

	struct crypto_skcipher *tfm = pask->private;

	unsigned int bs = crypto_skcipher_blocksize(tfm);

	unsigned int bs = crypto_skcipher_chunksize(tfm);

	struct af_alg_async_req *areq;

	int err = 0;

	size_t len = 0;
@@ -131,7 +131,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, 
			crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);



		/* AIO operation in progress */

		if (err == -EINPROGRESS || err == -EBUSY)

		if (err == -EINPROGRESS)

			return -EIOCBQUEUED;



		sock_put(sk);

crypto/rsa-pkcs1pad.c

+2 −0
Original line number Diff line number Diff line
@@ -475,6 +475,8 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err) 
		goto done;

	pos++;



	if (digest_info->size > dst_len - pos)

		goto done;

	if (crypto_memneq(out_buf + pos, digest_info->data, digest_info->size))

		goto done;

drivers/base/component.c

+4 −4
Original line number Diff line number Diff line
@@ -74,11 +74,11 @@ static int component_devices_show(struct seq_file *s, void *data) 
	seq_printf(s, "%-40s %20s\n", "device name", "status");

	seq_puts(s, "-------------------------------------------------------------\n");

	for (i = 0; i < match->num; i++) {

		struct device *d = (struct device *)match->compare[i].data;

		struct component *component = match->compare[i].component;



		seq_printf(s, "%-40s %20s\n", dev_name(d),

			   match->compare[i].component ?

			   "registered" : "not registered");

		seq_printf(s, "%-40s %20s\n",

			   component ? dev_name(component->dev) : "(unknown)",

			   component ? (component->bound ? "bound" : "not bound") : "not registered");

	}

	mutex_unlock(&component_mutex);

drivers/char/ipmi/ipmi_msghandler.c

+4 −23
Original line number Diff line number Diff line
@@ -44,25 +44,6 @@ static void need_waiter(struct ipmi_smi *intf); 
static int handle_one_recv_msg(struct ipmi_smi *intf,

			       struct ipmi_smi_msg *msg);



#ifdef DEBUG

static void ipmi_debug_msg(const char *title, unsigned char *data,

			   unsigned int len)

{

	int i, pos;

	char buf[100];



	pos = snprintf(buf, sizeof(buf), "%s: ", title);

	for (i = 0; i < len; i++)

		pos += snprintf(buf + pos, sizeof(buf) - pos,

				" %2.2x", data[i]);

	pr_debug("%s\n", buf);

}

#else

static void ipmi_debug_msg(const char *title, unsigned char *data,

			   unsigned int len)

{ }

#endif



static bool initialized;

static bool drvregistered;
@@ -2204,7 +2185,7 @@ static int i_ipmi_request(struct ipmi_user *user, 
		ipmi_free_smi_msg(smi_msg);

		ipmi_free_recv_msg(recv_msg);

	} else {

		ipmi_debug_msg("Send", smi_msg->data, smi_msg->data_size);

		pr_debug("Send: %*ph\n", smi_msg->data_size, smi_msg->data);



		smi_send(intf, intf->handlers, smi_msg, priority);

	}
@@ -3675,7 +3656,7 @@ static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, 
		msg->data[10] = ipmb_checksum(&msg->data[6], 4);

		msg->data_size = 11;



		ipmi_debug_msg("Invalid command:", msg->data, msg->data_size);

		pr_debug("Invalid command: %*ph\n", msg->data_size, msg->data);



		rcu_read_lock();

		if (!intf->in_shutdown) {
@@ -4162,7 +4143,7 @@ static int handle_one_recv_msg(struct ipmi_smi *intf, 
	int requeue;

	int chan;



	ipmi_debug_msg("Recv:", msg->rsp, msg->rsp_size);

	pr_debug("Recv: %*ph\n", msg->rsp_size, msg->rsp);

	if (msg->rsp_size < 2) {

		/* Message is too small to be correct. */

		dev_warn(intf->si_dev,
@@ -4520,7 +4501,7 @@ smi_from_recv_msg(struct ipmi_smi *intf, struct ipmi_recv_msg *recv_msg, 
	smi_msg->data_size = recv_msg->msg.data_len;

	smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);



	ipmi_debug_msg("Resend: ", smi_msg->data, smi_msg->data_size);

	pr_debug("Resend: %*ph\n", smi_msg->data_size, smi_msg->data);



	return smi_msg;

}

drivers/iommu/iommu-sysfs.c

+5 −0
Original line number Diff line number Diff line
@@ -90,6 +90,7 @@ int iommu_device_sysfs_add(struct iommu_device *iommu, 
	put_device(iommu->dev);

	return ret;

}

EXPORT_SYMBOL_GPL(iommu_device_sysfs_add);



void iommu_device_sysfs_remove(struct iommu_device *iommu)

{
@@ -97,6 +98,8 @@ void iommu_device_sysfs_remove(struct iommu_device *iommu) 
	device_unregister(iommu->dev);

	iommu->dev = NULL;

}

EXPORT_SYMBOL_GPL(iommu_device_sysfs_remove);



/*

 * IOMMU drivers can indicate a device is managed by a given IOMMU using

 * this interface.  A link to the device will be created in the "devices"
@@ -122,6 +125,7 @@ int iommu_device_link(struct iommu_device *iommu, struct device *link) 


	return ret;

}

EXPORT_SYMBOL_GPL(iommu_device_link);



void iommu_device_unlink(struct iommu_device *iommu, struct device *link)

{
@@ -131,3 +135,4 @@ void iommu_device_unlink(struct iommu_device *iommu, struct device *link) 
	sysfs_remove_link(&link->kobj, "iommu");

	sysfs_remove_link_from_group(&iommu->dev->kobj, "devices", dev_name(link));

}

EXPORT_SYMBOL_GPL(iommu_device_unlink);