From 08fd1612fa2ffb9f9e988cf33afbc2edca63a9ba Mon Sep 17 00:00:00 2001 From: Augusto Caringi Date: Mon, 15 Jan 2024 21:47:15 -0300 Subject: [PATCH] kernel-6.6.12-200 * Mon Jan 15 2024 Augusto Caringi [6.6.12-0] - Add CVE Fixes to BugsFixed for 6.6.12 (Justin M. Forbes) - ida: Fix crash in ida_free when the bitmap is empty (Matthew Wilcox (Oracle)) - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Xingyuan Mo) - Linux v6.6.12 Resolves: Signed-off-by: Augusto Caringi --- Patchlist.changelog | 6 +++ kernel.spec | 14 +++++-- patch-6.6-redhat.patch | 93 +++++++++++++++++++++++++++++++++++++++++- sources | 6 +-- 4 files changed, 110 insertions(+), 9 deletions(-) diff --git a/Patchlist.changelog b/Patchlist.changelog index 0d8e46a4f..7a6ee75c9 100644 --- a/Patchlist.changelog +++ b/Patchlist.changelog @@ -1,3 +1,9 @@ +"https://gitlab.com/cki-project/kernel-ark/-/commit"/bbdede94e2dfb64c3fdb376f90222394422d0131 + bbdede94e2dfb64c3fdb376f90222394422d0131 ida: Fix crash in ida_free when the bitmap is empty + +"https://gitlab.com/cki-project/kernel-ark/-/commit"/ed93ec720e04b598e451e23635bd8201ecaf9c60 + ed93ec720e04b598e451e23635bd8201ecaf9c60 wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() + "https://gitlab.com/cki-project/kernel-ark/-/commit"/becca34be9cd8577a101032917438af982aa7d29 becca34be9cd8577a101032917438af982aa7d29 ALSA: hda: cs35l41: Add notification support into component binding diff --git a/kernel.spec b/kernel.spec index 91e45becf..f55238554 100644 --- a/kernel.spec +++ b/kernel.spec @@ -160,18 +160,18 @@ Summary: The Linux kernel # the --with-release option overrides this setting.) %define debugbuildsenabled 1 # define buildid .local -%define specrpmversion 6.6.11 -%define specversion 6.6.11 +%define specrpmversion 6.6.12 +%define specversion 6.6.12 %define patchversion 6.6 %define pkgrelease 200 %define kversion 6 -%define tarfile_release 6.6.11 +%define tarfile_release 6.6.12 # This is needed to do merge window version magic %define patchlevel 6 # This allows pkg_release to have configurable %%{?dist} tag %define specrelease 200%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 6.6.11 +%define kabiversion 6.6.12 # If this variable is set to 1, a bpf selftests build failure will cause a # fatal kernel package build error @@ -3709,6 +3709,12 @@ fi\ # # %changelog +* Mon Jan 15 2024 Augusto Caringi [6.6.12-0] +- Add CVE Fixes to BugsFixed for 6.6.12 (Justin M. Forbes) +- ida: Fix crash in ida_free when the bitmap is empty (Matthew Wilcox (Oracle)) +- wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Xingyuan Mo) +- Linux v6.6.12 + * Wed Jan 10 2024 Augusto Caringi [6.6.11-0] - Linux v6.6.11 diff --git a/patch-6.6-redhat.patch b/patch-6.6-redhat.patch index c29959199..05988e98f 100644 --- a/patch-6.6-redhat.patch +++ b/patch-6.6-redhat.patch @@ -17,6 +17,7 @@ drivers/hwtracing/coresight/coresight-etm4x-core.c | 19 ++ drivers/input/rmi4/rmi_driver.c | 124 ++++--- drivers/iommu/iommu.c | 22 ++ + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 + drivers/pci/quirks.c | 24 ++ drivers/rtc/rtc-cmos.c | 18 +- drivers/scsi/sd.c | 10 + @@ -29,6 +30,8 @@ include/linux/security.h | 5 + kernel/module/main.c | 2 + kernel/module/signing.c | 9 +- + lib/idr.c | 2 +- + lib/test_ida.c | 40 +++ scripts/mod/modpost.c | 8 + scripts/tags.sh | 2 + security/integrity/platform_certs/load_uefi.c | 6 +- @@ -40,10 +43,10 @@ sound/pci/hda/cs35l41_hda_property.c | 355 +++++++++++++++++++-- sound/pci/hda/hda_component.h | 4 + sound/pci/hda/patch_realtek.c | 39 ++- - 42 files changed, 1132 insertions(+), 242 deletions(-) + 45 files changed, 1177 insertions(+), 243 deletions(-) diff --git a/Makefile b/Makefile -index 43edafa7f262..e8455933ff74 100644 +index a05c69afc045..4adac135cb4d 100644 --- a/Makefile +++ b/Makefile @@ -22,6 +22,18 @@ $(if $(filter __%, $(MAKECMDGOALS)), \ @@ -968,6 +971,21 @@ index 3a67e636287a..eb5e796277d6 100644 /** * iommu_setup_default_domain - Set the default_domain for the group * @group: Group to change +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 6b6aa3c36744..0ce08e9a0a3d 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -851,6 +851,10 @@ ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev(struct ath10k *ar, struct sk_buff *skb, + } + + ev = tb[WMI_TLV_TAG_STRUCT_MGMT_TX_COMPL_EVENT]; ++ if (!ev) { ++ kfree(tb); ++ return -EPROTO; ++ } + + arg->desc_id = ev->desc_id; + arg->status = ev->status; diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index ae95d0950772..459f2b50d422 100644 --- a/drivers/pci/quirks.c @@ -1433,6 +1451,77 @@ index a2ff4242e623..f0d2be1ee4f1 100644 } int module_sig_check(struct load_info *info, int flags) +diff --git a/lib/idr.c b/lib/idr.c +index 13f2758c2377..da36054c3ca0 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id) + goto delete; + xas_store(&xas, xa_mk_value(v)); + } else { +- if (!test_bit(bit, bitmap->bitmap)) ++ if (!bitmap || !test_bit(bit, bitmap->bitmap)) + goto err; + __clear_bit(bit, bitmap->bitmap); + xas_set_mark(&xas, XA_FREE_MARK); +diff --git a/lib/test_ida.c b/lib/test_ida.c +index b06880625961..55105baa19da 100644 +--- a/lib/test_ida.c ++++ b/lib/test_ida.c +@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) + IDA_BUG_ON(ida, !ida_is_empty(ida)); + } + ++/* ++ * Check various situations where we attempt to free an ID we don't own. ++ */ ++static void ida_check_bad_free(struct ida *ida) ++{ ++ unsigned long i; ++ ++ printk("vvv Ignore \"not allocated\" warnings\n"); ++ /* IDA is empty; all of these will fail */ ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single value entry */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single bitmap */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a tree */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ printk("^^^ \"not allocated\" warnings over\n"); ++ ++ ida_free(ida, 3); ++ ida_free(ida, 1023); ++ ida_free(ida, (1 << 20) - 1); ++ ++ IDA_BUG_ON(ida, !ida_is_empty(ida)); ++} ++ + static DEFINE_IDA(ida); + + static int ida_checks(void) +@@ -162,6 +201,7 @@ static int ida_checks(void) + ida_check_leaf(&ida, 1024 * 64); + ida_check_max(&ida); + ida_check_conv(&ida); ++ ida_check_bad_free(&ida); + + printk("IDA: %u of %u tests passed\n", tests_passed, tests_run); + return (tests_run != tests_passed) ? 0 : -EINVAL; diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index ac4ef3e206bb..80ede130812c 100644 --- a/scripts/mod/modpost.c diff --git a/sources b/sources index adcc16c43..b6b2b6037 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ SHA512 (kernel-abi-stablelists-6.5.12.tar.bz2) = 7130ba0d72e398ae63bd0192e5e765885d8b932ff10c22f214821387588c358a21c8460561993baab0e5cd48afbad08db822cc49e5e3ae2d927b328de2072e7a SHA512 (kernel-kabi-dw-6.5.12.tar.bz2) = 7fc7372de576d1f3602abe70483edf30cf635a6d4175261bb44e1b7d4b413bc045b1e2affc0dbe6bf710a7c10b4a5c26c7fd47d8b8e7fe4bee2a25e2fd80b13a -SHA512 (linux-6.6.11.tar.xz) = 86e543442e88764bebaaf744cdd606dd993795941e595415ab4a2c5c6f3d2bd07e8b1d7567f8ad57afa2f0bb6beb1b282bf59cb3c9a0de4b83d248ac11410291 -SHA512 (kernel-abi-stablelists-6.6.11.tar.xz) = 603a5c968d98ba9bbd6abc839bf2ba9aaa58c79827a1f5429b13adfc6b18ff92c8153eeeeaf01a948433e93d0917eac3181bea392c48c49f0f32a63df0e338ab -SHA512 (kernel-kabi-dw-6.6.11.tar.xz) = 09c64fbdbcf718e4de9f25daadd61978fb243bd388bc733f71c07bb31fdf6f3588d58bad035ce8d79366cad67f1022dff42650dcd6869dcae1df7695b2c661ec +SHA512 (linux-6.6.12.tar.xz) = fa70e267b55b1976f8a37522649d184e96022be7072a319e67834ec40f854cbe19fc6b8124fe087683806d88535140fa6629c34c8e8b07714247991814f2c945 +SHA512 (kernel-abi-stablelists-6.6.12.tar.xz) = b1e20b05d0c459577b42997cdd4234a70dee95ae478e9228b70c4ae669b64c963eb4e1edff9d9a5bdd7d9ae9b1315b9424748eb4add4c98dc8265bbdbd723054 +SHA512 (kernel-kabi-dw-6.6.12.tar.xz) = cc4da677a15830f2808ad63ac221c7b6e7fafcbedb0c86651120d93d99cbf38f37a0204cefcef484d6e8fd128ede4d4beab66dd5a6f81572dba628df10614157