kernel-6.6.12-200
* Mon Jan 15 2024 Augusto Caringi <acaringi@redhat.com> [6.6.12-0] - Add CVE Fixes to BugsFixed for 6.6.12 (Justin M. Forbes) - ida: Fix crash in ida_free when the bitmap is empty (Matthew Wilcox (Oracle)) - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Xingyuan Mo) - Linux v6.6.12 Resolves: Signed-off-by: Augusto Caringi <acaringi@redhat.com>
This commit is contained in:
Augusto Caringi
parent
49b04e4829
commit
08fd1612fa
4 changed files with 110 additions and 9 deletions
|
|
@ -1,3 +1,9 @@
|
|||
"https://gitlab.com/cki-project/kernel-ark/-/commit"/bbdede94e2dfb64c3fdb376f90222394422d0131
|
||||
bbdede94e2dfb64c3fdb376f90222394422d0131 ida: Fix crash in ida_free when the bitmap is empty
|
||||
|
||||
"https://gitlab.com/cki-project/kernel-ark/-/commit"/ed93ec720e04b598e451e23635bd8201ecaf9c60
|
||||
ed93ec720e04b598e451e23635bd8201ecaf9c60 wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
|
||||
|
||||
"https://gitlab.com/cki-project/kernel-ark/-/commit"/becca34be9cd8577a101032917438af982aa7d29
|
||||
becca34be9cd8577a101032917438af982aa7d29 ALSA: hda: cs35l41: Add notification support into component binding
|
||||
|
||||
|
|
|
|||
14
kernel.spec
14
kernel.spec
|
|
@ -160,18 +160,18 @@ Summary: The Linux kernel
|
|||
# the --with-release option overrides this setting.)
|
||||
%define debugbuildsenabled 1
|
||||
# define buildid .local
|
||||
%define specrpmversion 6.6.11
|
||||
%define specversion 6.6.11
|
||||
%define specrpmversion 6.6.12
|
||||
%define specversion 6.6.12
|
||||
%define patchversion 6.6
|
||||
%define pkgrelease 200
|
||||
%define kversion 6
|
||||
%define tarfile_release 6.6.11
|
||||
%define tarfile_release 6.6.12
|
||||
# This is needed to do merge window version magic
|
||||
%define patchlevel 6
|
||||
# This allows pkg_release to have configurable %%{?dist} tag
|
||||
%define specrelease 200%{?buildid}%{?dist}
|
||||
# This defines the kabi tarball version
|
||||
%define kabiversion 6.6.11
|
||||
%define kabiversion 6.6.12
|
||||
|
||||
# If this variable is set to 1, a bpf selftests build failure will cause a
|
||||
# fatal kernel package build error
|
||||
|
|
@ -3709,6 +3709,12 @@ fi\
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Mon Jan 15 2024 Augusto Caringi <acaringi@redhat.com> [6.6.12-0]
|
||||
- Add CVE Fixes to BugsFixed for 6.6.12 (Justin M. Forbes)
|
||||
- ida: Fix crash in ida_free when the bitmap is empty (Matthew Wilcox (Oracle))
|
||||
- wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Xingyuan Mo)
|
||||
- Linux v6.6.12
|
||||
|
||||
* Wed Jan 10 2024 Augusto Caringi <acaringi@redhat.com> [6.6.11-0]
|
||||
- Linux v6.6.11
|
||||
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@
|
|||
drivers/hwtracing/coresight/coresight-etm4x-core.c | 19 ++
|
||||
drivers/input/rmi4/rmi_driver.c | 124 ++++---
|
||||
drivers/iommu/iommu.c | 22 ++
|
||||
drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +
|
||||
drivers/pci/quirks.c | 24 ++
|
||||
drivers/rtc/rtc-cmos.c | 18 +-
|
||||
drivers/scsi/sd.c | 10 +
|
||||
|
|
@ -29,6 +30,8 @@
|
|||
include/linux/security.h | 5 +
|
||||
kernel/module/main.c | 2 +
|
||||
kernel/module/signing.c | 9 +-
|
||||
lib/idr.c | 2 +-
|
||||
lib/test_ida.c | 40 +++
|
||||
scripts/mod/modpost.c | 8 +
|
||||
scripts/tags.sh | 2 +
|
||||
security/integrity/platform_certs/load_uefi.c | 6 +-
|
||||
|
|
@ -40,10 +43,10 @@
|
|||
sound/pci/hda/cs35l41_hda_property.c | 355 +++++++++++++++++++--
|
||||
sound/pci/hda/hda_component.h | 4 +
|
||||
sound/pci/hda/patch_realtek.c | 39 ++-
|
||||
42 files changed, 1132 insertions(+), 242 deletions(-)
|
||||
45 files changed, 1177 insertions(+), 243 deletions(-)
|
||||
|
||||
diff --git a/Makefile b/Makefile
|
||||
index 43edafa7f262..e8455933ff74 100644
|
||||
index a05c69afc045..4adac135cb4d 100644
|
||||
--- a/Makefile
|
||||
+++ b/Makefile
|
||||
@@ -22,6 +22,18 @@ $(if $(filter __%, $(MAKECMDGOALS)), \
|
||||
|
|
@ -968,6 +971,21 @@ index 3a67e636287a..eb5e796277d6 100644
|
|||
/**
|
||||
* iommu_setup_default_domain - Set the default_domain for the group
|
||||
* @group: Group to change
|
||||
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
|
||||
index 6b6aa3c36744..0ce08e9a0a3d 100644
|
||||
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
|
||||
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
|
||||
@@ -851,6 +851,10 @@ ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev(struct ath10k *ar, struct sk_buff *skb,
|
||||
}
|
||||
|
||||
ev = tb[WMI_TLV_TAG_STRUCT_MGMT_TX_COMPL_EVENT];
|
||||
+ if (!ev) {
|
||||
+ kfree(tb);
|
||||
+ return -EPROTO;
|
||||
+ }
|
||||
|
||||
arg->desc_id = ev->desc_id;
|
||||
arg->status = ev->status;
|
||||
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
|
||||
index ae95d0950772..459f2b50d422 100644
|
||||
--- a/drivers/pci/quirks.c
|
||||
|
|
@ -1433,6 +1451,77 @@ index a2ff4242e623..f0d2be1ee4f1 100644
|
|||
}
|
||||
|
||||
int module_sig_check(struct load_info *info, int flags)
|
||||
diff --git a/lib/idr.c b/lib/idr.c
|
||||
index 13f2758c2377..da36054c3ca0 100644
|
||||
--- a/lib/idr.c
|
||||
+++ b/lib/idr.c
|
||||
@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id)
|
||||
goto delete;
|
||||
xas_store(&xas, xa_mk_value(v));
|
||||
} else {
|
||||
- if (!test_bit(bit, bitmap->bitmap))
|
||||
+ if (!bitmap || !test_bit(bit, bitmap->bitmap))
|
||||
goto err;
|
||||
__clear_bit(bit, bitmap->bitmap);
|
||||
xas_set_mark(&xas, XA_FREE_MARK);
|
||||
diff --git a/lib/test_ida.c b/lib/test_ida.c
|
||||
index b06880625961..55105baa19da 100644
|
||||
--- a/lib/test_ida.c
|
||||
+++ b/lib/test_ida.c
|
||||
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida)
|
||||
IDA_BUG_ON(ida, !ida_is_empty(ida));
|
||||
}
|
||||
|
||||
+/*
|
||||
+ * Check various situations where we attempt to free an ID we don't own.
|
||||
+ */
|
||||
+static void ida_check_bad_free(struct ida *ida)
|
||||
+{
|
||||
+ unsigned long i;
|
||||
+
|
||||
+ printk("vvv Ignore \"not allocated\" warnings\n");
|
||||
+ /* IDA is empty; all of these will fail */
|
||||
+ ida_free(ida, 0);
|
||||
+ for (i = 0; i < 31; i++)
|
||||
+ ida_free(ida, 1 << i);
|
||||
+
|
||||
+ /* IDA contains a single value entry */
|
||||
+ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3);
|
||||
+ ida_free(ida, 0);
|
||||
+ for (i = 0; i < 31; i++)
|
||||
+ ida_free(ida, 1 << i);
|
||||
+
|
||||
+ /* IDA contains a single bitmap */
|
||||
+ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023);
|
||||
+ ida_free(ida, 0);
|
||||
+ for (i = 0; i < 31; i++)
|
||||
+ ida_free(ida, 1 << i);
|
||||
+
|
||||
+ /* IDA contains a tree */
|
||||
+ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1);
|
||||
+ ida_free(ida, 0);
|
||||
+ for (i = 0; i < 31; i++)
|
||||
+ ida_free(ida, 1 << i);
|
||||
+ printk("^^^ \"not allocated\" warnings over\n");
|
||||
+
|
||||
+ ida_free(ida, 3);
|
||||
+ ida_free(ida, 1023);
|
||||
+ ida_free(ida, (1 << 20) - 1);
|
||||
+
|
||||
+ IDA_BUG_ON(ida, !ida_is_empty(ida));
|
||||
+}
|
||||
+
|
||||
static DEFINE_IDA(ida);
|
||||
|
||||
static int ida_checks(void)
|
||||
@@ -162,6 +201,7 @@ static int ida_checks(void)
|
||||
ida_check_leaf(&ida, 1024 * 64);
|
||||
ida_check_max(&ida);
|
||||
ida_check_conv(&ida);
|
||||
+ ida_check_bad_free(&ida);
|
||||
|
||||
printk("IDA: %u of %u tests passed\n", tests_passed, tests_run);
|
||||
return (tests_run != tests_passed) ? 0 : -EINVAL;
|
||||
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
|
||||
index ac4ef3e206bb..80ede130812c 100644
|
||||
--- a/scripts/mod/modpost.c
|
||||
|
|
|
|||
6
sources
6
sources
|
|
@ -1,5 +1,5 @@
|
|||
SHA512 (kernel-abi-stablelists-6.5.12.tar.bz2) = 7130ba0d72e398ae63bd0192e5e765885d8b932ff10c22f214821387588c358a21c8460561993baab0e5cd48afbad08db822cc49e5e3ae2d927b328de2072e7a
|
||||
SHA512 (kernel-kabi-dw-6.5.12.tar.bz2) = 7fc7372de576d1f3602abe70483edf30cf635a6d4175261bb44e1b7d4b413bc045b1e2affc0dbe6bf710a7c10b4a5c26c7fd47d8b8e7fe4bee2a25e2fd80b13a
|
||||
SHA512 (linux-6.6.11.tar.xz) = 86e543442e88764bebaaf744cdd606dd993795941e595415ab4a2c5c6f3d2bd07e8b1d7567f8ad57afa2f0bb6beb1b282bf59cb3c9a0de4b83d248ac11410291
|
||||
SHA512 (kernel-abi-stablelists-6.6.11.tar.xz) = 603a5c968d98ba9bbd6abc839bf2ba9aaa58c79827a1f5429b13adfc6b18ff92c8153eeeeaf01a948433e93d0917eac3181bea392c48c49f0f32a63df0e338ab
|
||||
SHA512 (kernel-kabi-dw-6.6.11.tar.xz) = 09c64fbdbcf718e4de9f25daadd61978fb243bd388bc733f71c07bb31fdf6f3588d58bad035ce8d79366cad67f1022dff42650dcd6869dcae1df7695b2c661ec
|
||||
SHA512 (linux-6.6.12.tar.xz) = fa70e267b55b1976f8a37522649d184e96022be7072a319e67834ec40f854cbe19fc6b8124fe087683806d88535140fa6629c34c8e8b07714247991814f2c945
|
||||
SHA512 (kernel-abi-stablelists-6.6.12.tar.xz) = b1e20b05d0c459577b42997cdd4234a70dee95ae478e9228b70c4ae669b64c963eb4e1edff9d9a5bdd7d9ae9b1315b9424748eb4add4c98dc8265bbdbd723054
|
||||
SHA512 (kernel-kabi-dw-6.6.12.tar.xz) = cc4da677a15830f2808ad63ac221c7b6e7fafcbedb0c86651120d93d99cbf38f37a0204cefcef484d6e8fd128ede4d4beab66dd5a6f81572dba628df10614157
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue