Unverified Commit 693a53a5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!575 Backport CVEs and bugfixes 

Merge Pull Request from: @zhangjialin11 
 
Pull new CVEs:
CVE-2023-1859
CVE-2023-1670
CVE-2023-1611

net bugfixes from Ziyang Xuan
ubi bugfixes from ZhaoLong Wang
ftrace and ring-buffer bugfixes from Zheng Yejian
perf bugfix from Yang Jihong
loop bugfix from Zhong Jinghua
ext4 bugfixes from Zhihao Cheng
dm crypt bugfix from yangerkun
driver core bugfixes from Zhang Zekun
xfs bugfixes from Long Li 
 
Link:https://gitee.com/openeuler/kernel/pulls/575

 

Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents 622c640a c1065432

drivers/base/core.c

+0 −2
Original line number Diff line number Diff line
@@ -1092,10 +1092,8 @@ static ssize_t waiting_for_supplier_show(struct device *dev, 
	bool val;



	device_lock(dev);

	mutex_lock(&wfs_lock);

	val = !list_empty(&dev->links.needs_suppliers)

	      && dev->links.need_for_probe;

	mutex_unlock(&wfs_lock);

	device_unlock(dev);

	return sysfs_emit(buf, "%u\n", val);

}

drivers/base/platform.c

+2 −0
Original line number Diff line number Diff line
@@ -351,6 +351,8 @@ int devm_platform_get_irqs_affinity(struct platform_device *dev, 
		return -ERANGE;



	nvec = platform_irq_count(dev);

	if (nvec < 0)

		return nvec;



	if (nvec < minvec)

		return -ENOSPC;

drivers/block/loop.c

+13 −1
Original line number Diff line number Diff line
@@ -2084,6 +2084,17 @@ static int loop_add(struct loop_device **l, int i) 
	struct gendisk *disk;

	int err;



	/*

	 * i << part_shift is actually used as the first_minor.

	 * So here should avoid i << part_shift overflow.

	 * And, MKDEV() expect that the max bits of

	 * first_minor is 20.

	 */

	if (i > 0 && i > MINORMASK >> part_shift) {

		err = -EINVAL;

		goto out;

	}



	err = -ENOMEM;

	lo = kzalloc(sizeof(*lo), GFP_KERNEL);

	if (!lo)
@@ -2097,7 +2108,8 @@ static int loop_add(struct loop_device **l, int i) 
		if (err == -ENOSPC)

			err = -EEXIST;

	} else {

		err = idr_alloc(&loop_index_idr, lo, 0, 0, GFP_KERNEL);

		err = idr_alloc(&loop_index_idr, lo, 0,

				(MINORMASK >> part_shift) + 1, GFP_KERNEL);

	}

	if (err < 0)

		goto out_free_dev;

drivers/md/dm-crypt.c

+1 −0
Original line number Diff line number Diff line
@@ -1934,6 +1934,7 @@ static int dmcrypt_write(void *data) 
			io = crypt_io_from_node(rb_first(&write_tree));

			rb_erase(&io->rb_node, &write_tree);

			kcryptd_io_write(io);

			cond_resched();

		} while (!RB_EMPTY_ROOT(&write_tree));

		blk_finish_plug(&plug);

	}

drivers/mtd/ubi/build.c

+15 −0
Original line number Diff line number Diff line
@@ -683,6 +683,21 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024) 
						ubi->vid_hdr_aloffset;

	}



	/*

	 * Memory allocation for VID header is ubi->vid_hdr_alsize

	 * which is described in comments in io.c.

	 * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds

	 * ubi->vid_hdr_alsize, so that all vid header operations

	 * won't access memory out of bounds.

	 */

	if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) {

		ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)"

			" + VID header size(%zu) > VID header aligned size(%d).",

			ubi->vid_hdr_offset, ubi->vid_hdr_shift,

			UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize);

		return -EINVAL;

	}



	/* Similar for the data offset */

	ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE;

	ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size);