almalinux/kernel
14
1
Fork 0
Code Issues Pull Requests Releases Activity

Import of kernel-4.18.0-553.158.1.el8_10

Browse Source
This commit is contained in:
almalinux-bot-kernel 2026-08-27 06:10:51 +00:00
parent 664b924c93
commit 57e502d298
15 changed files with 164 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile.rhelver
View File

@ -12,7 +12,7 @@ RHEL_MINOR = 10
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 553.157.1
RHEL_RELEASE = 553.158.1
#
# ZSTREAM

5
drivers/i2c/i2c-stub.c
View File

@ -215,6 +215,11 @@ static s32 stub_xfer(struct i2c_adapter *adap, u16 addr, unsigned short flags,
* We ignore banks here, because banked chips don't use I2C
* block transfers
*/
if (data->block[0] == 0 ||
data->block[0] > I2C_SMBUS_BLOCK_MAX) {
ret = -EINVAL;
break;
}
if (data->block[0] > 256 - command) /* Avoid overrun */
data->block[0] = 256 - command;
len = data->block[0];

2
drivers/input/rmi4/rmi_f30.c
View File

@ -233,7 +233,7 @@ static int rmi_f30_map_gpios(struct rmi_function *fn,
int button_count = min_t(u8, f30->gpioled_count, TRACKSTICK_RANGE_END);
f30->gpioled_key_map = devm_kcalloc(&fn->dev,
button_count,
f30->gpioled_count,
sizeof(f30->gpioled_key_map[0]),
GFP_KERNEL);
if (!f30->gpioled_key_map) {

2
drivers/input/rmi4/rmi_f3a.c
View File

@ -132,7 +132,7 @@ static int rmi_f3a_map_gpios(struct rmi_function *fn, struct f3a_data *f3a,
int button_count = min_t(u8, f3a->gpio_count, TRACKSTICK_RANGE_END);
f3a->gpio_key_map = devm_kcalloc(&fn->dev,
button_count,
f3a->gpio_count,
sizeof(f3a->gpio_key_map[0]),
GFP_KERNEL);
if (!f3a->gpio_key_map) {

23
drivers/nvme/target/discovery.c
View File

@ -174,6 +174,7 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req)
u64 offset = nvmet_get_log_page_offset(req->cmd);
size_t data_len = nvmet_get_log_page_len(req->cmd);
size_t alloc_len;
size_t copy_len;
struct nvmet_subsys_link *p;
struct nvmet_port *r;
u32 numrec = 0;
@ -242,7 +243,27 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req)
up_read(&nvmet_config_sem);
status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);
/*
* Validate the host-supplied log page offset before copying out.
* Without this check, the host controls a 64-bit byte offset into
* a small kzalloc'd buffer: a value past the log page lets the
* subsequent memcpy read adjacent kernel heap, and a value aimed
* at unmapped kernel memory faults the in-kernel copy and crashes
* the target host. The Discovery controller is unauthenticated,
* so the bug is reachable from any reachable fabric peer.
*/
if (offset > alloc_len) {
req->error_loc =
offsetof(struct nvme_get_log_page_command, lpo);
status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
goto out_free_buffer;
}
copy_len = min_t(size_t, data_len, alloc_len - offset);
status = nvmet_copy_to_sgl(req, 0, buffer + offset, copy_len);
if (!status && copy_len < data_len)
status = nvmet_zero_sgl(req, copy_len, data_len - copy_len);
out_free_buffer:
kfree(buffer);
out:
nvmet_req_complete(req, status);

25
drivers/target/iscsi/iscsi_target_auth.c
View File

@ -347,13 +347,22 @@ static int chap_server_compute_hash(
goto out;
}
break;
case BASE64:
case BASE64: {
size_t r_len = strlen(chap_r);
while (r_len > 0 && chap_r[r_len - 1] == '=')
r_len--;
if (r_len > DIV_ROUND_UP(chap->digest_size * 4, 3)) {
pr_err("Malformed CHAP_R: base64 payload too long\n");
goto out;
}
if (chap_base64_decode(client_digest, chap_r, strlen(chap_r)) !=
chap->digest_size) {
pr_err("Malformed CHAP_R: invalid BASE64\n");
goto out;
}
break;
}
default:
pr_err("Could not find CHAP_R\n");
goto out;
@ -437,9 +446,11 @@ static int chap_server_compute_hash(
}
if (type == HEX)
ret = kstrtoul(&identifier[2], 0, &id);
ret = kstrtoul(identifier, 16, &id);
else if (type == DECIMAL)
ret = kstrtoul(identifier, 10, &id);
else
ret = kstrtoul(identifier, 0, &id);
ret = -EINVAL;
if (ret < 0) {
pr_err("kstrtoul() failed for CHAP identifier: %d\n", ret);
@ -481,6 +492,14 @@ static int chap_server_compute_hash(
}
break;
case BASE64:
/*
* No overflow check needed: initiatorchg_binhex is
* CHAP_CHALLENGE_STR_LEN bytes and extract_param() caps
* initiatorchg at CHAP_CHALLENGE_STR_LEN characters, so
* the decoded output is at most DIV_ROUND_UP(
* (CHAP_CHALLENGE_STR_LEN - 1) * 3, 4) bytes, which is
* less than CHAP_CHALLENGE_STR_LEN.
*/
initiatorchg_len = chap_base64_decode(initiatorchg_binhex,
initiatorchg,
strlen(initiatorchg));

11
drivers/usb/core/hub.c
View File

@ -30,6 +30,7 @@
#include <linux/random.h>
#include <linux/pm_qos.h>
#include <linux/kobject.h>
#include <linux/sched/isolation.h>
#include <linux/bitfield.h>
#include <linux/uaccess.h>
@ -5968,6 +5969,8 @@ static struct usb_driver hub_driver = {
int usb_hub_init(void)
{
unsigned int wq_flags = 0;
if (usb_register(&hub_driver) < 0) {
printk(KERN_ERR "%s: can't register hub driver\n",
usbcore_name);
@ -5979,8 +5982,14 @@ int usb_hub_init(void)
* USB-PERSIST port handover. Otherwise it might see that a full-speed
* device was gone before the EHCI controller had handed its port
* over to the companion full-speed controller.
*
* Create WQ_UNBOUND workqueue instead of the default percpu workqueue
* if either isolcpus or nohz_full boot option is specified.
*/
hub_wq = alloc_workqueue("usb_hub_wq", WQ_FREEZABLE, 0);
if (housekeeping_enabled(HK_FLAG_DOMAIN | HK_FLAG_WQ))
wq_flags = WQ_UNBOUND;
hub_wq = alloc_workqueue("usb_hub_wq", WQ_FREEZABLE | wq_flags, 0);
if (hub_wq)
return 0;

3
include/net/sctp/sctp.h
View File

@ -132,7 +132,8 @@ int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net,
const union sctp_addr *paddr, void *p);
int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
struct net *net, int *pos, void *p);
int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p);
int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
struct net *net, int *pos, void *p);
int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
struct sctp_info *info);

2
kernel.sbat
View File

@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel.centos,1,Red Hat,kernel-core,4.18.0-553.157.1.el8.x86_64,mailto:secalert@redhat.com
kernel.centos,1,Red Hat,kernel-core,4.18.0-553.158.1.el8.x86_64,mailto:secalert@redhat.com

8
net/netfilter/ipset/ip_set_core.c
View File

@ -1310,7 +1310,11 @@ ip_set_dump_done(struct netlink_callback *cb)
struct ip_set_net *inst =
(struct ip_set_net *)cb->args[IPSET_CB_NET];
ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
struct ip_set *set = ip_set_ref_netlink(inst, index);
struct ip_set *set;
rcu_read_lock();
set = ip_set_ref_netlink(inst, index);
rcu_read_unlock();
if (set->variant->uref)
set->variant->uref(set, cb, false);
@ -1507,7 +1511,9 @@ next_set:
release_refcount:
/* If there was an error or set is done, release set */
if (ret || !cb->args[IPSET_CB_ARG0]) {
rcu_read_lock();
set = ip_set_ref_netlink(inst, index);
rcu_read_unlock();
if (set->variant->uref)
set->variant->uref(set, cb, false);
pr_debug("release set %s\n", set->name);

3
net/netfilter/nf_conntrack_proto_tcp.c
View File

@ -1198,7 +1198,8 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
new_state = old_state;
}
if (((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
&& ct->proto.tcp.last_index == TCP_SYN_SET)
&& ct->proto.tcp.last_index == TCP_SYN_SET
&& ct->proto.tcp.last_dir != dir)
|| (!test_bit(IPS_ASSURED_BIT, &ct->status)
&& ct->proto.tcp.last_index == TCP_ACK_SET))
&& ntohl(th->ack_seq) == ct->proto.tcp.last_end) {

90
net/sctp/diag.c
View File

@ -88,19 +88,27 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
struct nlattr *attr;
void *info = NULL;
rcu_read_lock();
list_for_each_entry_rcu(laddr, address_list, list)
addrcnt++;
rcu_read_unlock();
attr = nla_reserve(skb, INET_DIAG_LOCALS, addrlen * addrcnt);
if (!attr)
return -EMSGSIZE;
info = nla_data(attr);
rcu_read_lock();
list_for_each_entry_rcu(laddr, address_list, list) {
memcpy(info, &laddr->a, sizeof(laddr->a));
memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
info += addrlen;
if (!--addrcnt)
break;
}
WARN_ON_ONCE(addrcnt);
rcu_read_unlock();
return 0;
}
@ -238,14 +246,15 @@ struct sctp_comm_param {
bool net_admin;
};
static size_t inet_assoc_attr_size(struct sctp_association *asoc)
static size_t inet_assoc_attr_size(struct sock *sk,
struct sctp_association *asoc)
{
int addrlen = sizeof(struct sockaddr_storage);
int addrcnt = 0;
struct sctp_sockaddr_entry *laddr;
list_for_each_entry_rcu(laddr, &asoc->base.bind_addr.address_list,
list)
list, lockdep_sock_is_held(sk))
addrcnt++;
return nla_total_size(sizeof(struct sctp_info))
@ -271,11 +280,14 @@ static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transport *t
if (err)
return err;
rep = nlmsg_new(inet_assoc_attr_size(assoc), GFP_KERNEL);
if (!rep)
return -ENOMEM;
lock_sock(sk);
rep = nlmsg_new(inet_assoc_attr_size(sk, assoc), GFP_KERNEL);
if (!rep) {
release_sock(sk);
return -ENOMEM;
}
if (ep != assoc->ep) {
err = -EAGAIN;
goto out;
@ -376,42 +388,39 @@ static int sctp_ep_dump(struct sctp_endpoint *ep, void *p)
struct sk_buff *skb = commp->skb;
struct netlink_callback *cb = commp->cb;
const struct inet_diag_req_v2 *r = commp->r;
struct net *net = sock_net(skb->sk);
struct inet_sock *inet = inet_sk(sk);
int err = 0;
if (!net_eq(sock_net(sk), net))
lock_sock(sk);
if (ep->base.dead)
goto out;
if (cb->args[4] < cb->args[1])
goto next;
if (!(r->idiag_states & TCPF_LISTEN) && !list_empty(&ep->asocs))
goto next;
/* Skip eps with assocs if non-LISTEN states were requested, since
* they'll be dumped by sctp_sock_dump() during assoc traversal.
*/
if ((r->idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)) &&
!list_empty(&ep->asocs))
goto out;
if (r->sdiag_family != AF_UNSPEC &&
sk->sk_family != r->sdiag_family)
goto next;
goto out;
if (r->id.idiag_sport != inet->inet_sport &&
r->id.idiag_sport)
goto next;
goto out;
if (r->id.idiag_dport != inet->inet_dport &&
r->id.idiag_dport)
goto next;
if (inet_sctp_diag_fill(sk, NULL, skb, r,
sk_user_ns(NETLINK_CB(cb->skb).sk),
NETLINK_CB(cb->skb).portid,
cb->nlh->nlmsg_seq, NLM_F_MULTI,
cb->nlh, commp->net_admin) < 0) {
err = 2;
goto out;
}
next:
cb->args[4]++;
err = inet_sctp_diag_fill(sk, NULL, skb, r,
sk_user_ns(NETLINK_CB(cb->skb).sk),
NETLINK_CB(cb->skb).portid,
cb->nlh->nlmsg_seq, NLM_F_MULTI,
cb->nlh, commp->net_admin);
out:
release_sock(sk);
return err;
}
@ -481,41 +490,40 @@ static void sctp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
.r = r,
.net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN),
};
int pos = cb->args[2];
int pos;
/* eps hashtable dumps
* args:
* 0 : if it will traversal listen sock
* 1 : to record the sock pos of this time's traversal
* 4 : to work as a temporary variable to traversal list
*/
if (cb->args[0] == 0) {
if (!(idiag_states & TCPF_LISTEN))
goto skip;
if (sctp_for_each_endpoint(sctp_ep_dump, &commp))
goto done;
skip:
if (idiag_states & TCPF_LISTEN) {
pos = cb->args[1];
if (sctp_for_each_endpoint(sctp_ep_dump, net, &pos,
&commp)) {
cb->args[1] = pos;
return;
}
}
cb->args[0] = 1;
cb->args[1] = 0;
cb->args[4] = 0;
}
if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
return;
/* asocs by transport hashtable dump
* args:
* 1 : to record the assoc pos of this time's traversal
* 2 : to record the transport pos of this time's traversal
* 3 : to mark if we have dumped the ep info of the current asoc
* 4 : to work as a temporary variable to traversal list
* 5 : to save the sk we get from travelsing the tsp list.
* 4 : to track position within ep->asocs list in sctp_sock_dump()
*/
if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
goto done;
pos = cb->args[2];
sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump,
net, &pos, &commp);
cb->args[2] = pos;
done:
cb->args[1] = cb->args[4];
cb->args[4] = 0;
}

6
net/sctp/sm_statefuns.c
View File

@ -2596,11 +2596,7 @@ static enum sctp_disposition sctp_sf_do_5_2_6_stale(
*/
sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
/* If we've sent any data bundled with COOKIE-ECHO we will need to
* resend
*/
sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
SCTP_TRANSPORT(asoc->peer.primary_path));
sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL());
/* Cast away the const modifier, as we want to just
* rerun it through as a sideffect.

29
net/sctp/socket.c
View File

@ -5565,24 +5565,39 @@ struct sctp_transport *sctp_transport_get_idx(struct net *net,
}
int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
void *p) {
int err = 0;
int hash = 0;
struct sctp_endpoint *ep;
struct net *net, int *pos, void *p) {
int err, hash = 0, idx = 0, start;
struct sctp_hashbucket *head;
struct sctp_endpoint *ep;
for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
hash++, head++) {
start = idx;
again:
read_lock_bh(&head->lock);
sctp_for_each_hentry(ep, &head->chain) {
err = cb(ep, p);
if (err)
if (sock_net(ep->base.sk) != net)
continue;
if (idx++ >= *pos) {
sctp_endpoint_hold(ep);
break;
}
}
read_unlock_bh(&head->lock);
if (ep) {
err = cb(ep, p);
sctp_endpoint_put(ep);
if (err)
return err;
(*pos)++;
idx = start;
goto again;
}
}
return err;
return 0;
}
EXPORT_SYMBOL_GPL(sctp_for_each_endpoint);

19
security/selinux/hooks.c
View File

@ -4981,7 +4981,24 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
int size)
{
return sock_has_perm(sock->sk, SOCKET__WRITE);
int rc;
struct sockaddr *const addr = msg->msg_name;
const int addrlen = msg->msg_namelen;
rc = sock_has_perm(sock->sk, SOCKET__WRITE);
if (rc)
return rc;
if (addr && (msg->msg_flags & MSG_FASTOPEN) &&
sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM &&
(sock->sk->sk_protocol == IPPROTO_TCP ||
sock->sk->sk_protocol == IPPROTO_MPTCP)) {
rc = selinux_socket_connect(sock, addr, addrlen);
if (rc)
return rc;
}
return 0;
}
static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,