Re: [PATCH] selftests/sgx: Fix an enclave built with extended instructions

On Wed, Apr 9, 2025 at 7:07 PM Dave Hansen wrote: > > On 4/9/25 09:55, Vladis Dronov wrote: > ... > > Fix this by adding "-mno-avx" to ENCL_CFLAGS in Makefile. Add some comments > > about this to code locations where enclave's xfrm field is set. > > >

[PATCH] selftests/sgx: Fix an enclave built with extended instructions

re enclave's xfrm field is set. Suggested-by: Dave Hansen Signed-off-by: Vladis Dronov --- an out-of-commit-message note: I would greatly appreciate if someone reviews and possibly fixes my wording of the commit message and the code comments. tools/testing/selftests/sgx/Makefile| 2

Re: [PATCH -v3] x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled

Hi, Jarkko, Kai, Thanks a ton for your suggestions and edits! Hi, Ingo, Thank you many tons for your help and attention to this small patch and a TIP submission! I wasn't expecting such an... immediate response to my small suggestion, honestly. Best regards, Vladis

[PATCH v2] x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled

to properly nofity a user about this condition. The X86_FEATURE_SGX_LC is a CPU feature that enables LE hash MSRs to be writable when running native enclaves, i.e. using a custom root key rather than the Intel proprietary key for enclave signing. Signed-off-by: Vladis Dronov --- an out-of

[PATCH] x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled

properly nofity a user about this condition. The X86_FEATURE_SGX_LC is a CPU feature that enables LE hash MSRs to be writable when running native enclaves, i.e. using a custom root key rather than the Intel proprietary key for enclave signing. Signed-off-by: Vladis Dronov --- an out-of-commit

Re: [PATCH] debugfs: Fix module state check condition

nt details to know and follow... > I'll go queue this up now, thanks. > > greg k-h Best regards, Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer

Re: [PATCH] debugfs: Fix module state check condition

Hello, Greg, all, - Original Message - > From: "Greg KH" > Subject: Re: [PATCH] debugfs: Fix module state check condition > ...skip... > > It's in my queue, but bugs you can only trigger while root are a bit > lower on the priority list :) Oh, apologies. I really thought this has been

Re: [PATCH] debugfs: Fix module state check condition

Hello, Dear maintainers, could you please look at the above patch, that previously was sent during a merge window? A customer which has reported this issue replied with a test result: > I ran the same test. > Started ib_write_bw traffic and started watch command to read RoCE > stats : watch -d -

[PATCH] debugfs: Fix module state check condition

The '#ifdef MODULE' check in the original commit does not work as intended. The code under the check is not built at all if CONFIG_DEBUG_FS=y. Fix this by using a correct check. Fixes: 275678e7a9be ("debugfs: Check module state before warning in {full/open}_proxy_open()") S

Re: [PATCH] powerpc: fix function annotations to avoid section mismatch warnings with gcc-10

(no matter what config or build system), and it is a good thing too :-) > > I haven't seen it in my GCC 10 builds, so there must be some other > subtlety. Probably it depends on details of the .config. > I've just had this building the latest upstream for the ppc64le w

Re: [PATCH] powerpc: fix function annotations to avoid section mismatch warnings with gcc-10

Hello, - Original Message - > From: "Segher Boessenkool" > To: "Vladis Dronov" > Cc: linuxppc-...@lists.ozlabs.org, "Aneesh Kumar K . V" > , linux-kernel@vger.kernel.org, > "Paul Mackerras" > Sent: Wednesday, July 29, 20

[PATCH] powerpc: fix function annotations to avoid section mismatch warnings with gcc-10

there are just a single callsite from another __init or __meminit function: __meminit remove_pagetable() -> remove_pud_table() -> remove_pmd_table() __init prom_init() -> setup_secure_guest() __init xive_spapr_init() -> xive_spapr_disabled() Signed-off-by: Vladis Dronov --- arch/po

Re: [PATCH v5.3-rc2] Bluetooth: hci_uart: check for missing tty operations

Hello, Greg, all, I've just double-checked your backports, indeed, they are fine. Check for operations is not added for protocols which does not use these operations. Thanks! Best regards, Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer - Original Me

Re: [PATCH v5.3-rc2] Bluetooth: hci_uart: check for missing tty operations

Thank you, Greg! I've just noticed the patch landed in the upstream and was going to start stable backports, but it appeared you've already done this. So, not only automated mailers are slow :) Best regards, Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Softwar

[PATCH v3] Bluetooth: hci_uart: check for missing tty operations

spend/resume PM functions") Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support") Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn399

[PATCH v2] Bluetooth: hci_ldisc: check for missing tty operations

ooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov --- out-of-commit-message-note: I believe, this is a good location for the check. This way we protect protocols which does not call tiocm[gs]et() or hci_uart_set_flow_control() but

Re: [PATCH] Bluetooth: hci_uart: check for missing tty operations in protocol handlers

, I will add it to the v2 fix. I guess a good place for it is hci_ldisc.c, near hci_uart_set_flow_control(), isn't it? Best regards, Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer - Original Message - > From: "Marcel Holtmann" > To: "

[PATCH] Bluetooth: hci_uart: check for missing tty operations in protocol handlers

812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov --- drivers/bluetooth/hci_ath.c | 3 +++ drivers/bluetooth/hci_bcm.c | 5 + drivers/bluetooth

Re: [PATCH] Bluetooth: hci_ldisc: check for missing tty operations

Hello, Marcel, I totally agree, the same came to my mind some time after sending the patch. Let me send a v2 in a while with drivers checking for needed tty operations presence. Best regards, Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer - Original Message

[PATCH] Bluetooth: hci_ldisc: check for missing tty operations

=1b42faa2848963564a5b1b7f8c837ea7b55ffa50 Reported-by: syzbot+79337b501d6aa974d...@syzkaller.appspotmail.com Cc: sta...@vger.kernel.org # v2.6.39+ Signed-off-by: Vladis Dronov --- drivers/bluetooth/hci_ath.c | 7 - drivers/bluetooth/hci_ldisc.c | 58 --- 2 files changed, 39 insertions

Re: [PATCH v2] HID: debug: fix the ring buffer implementation

> > I still think that > > > > __set_current_state(TASK_RUNNING); > > > > will look a bit better, but this is really minor. > > Would you mind sending a v3 with this change? I'll apply it ASAP. Done, please, see inbox. Best regards

[PATCH v3] HID: debug: fix the ring buffer implementation

1669187 Cc: sta...@vger.kernel.org # v4.18+ Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping") Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()") Signed-off-by: Vladis Dronov --- drivers/hid/hid-debug.c | 116 ++-

[PATCH v2] HID: debug: fix the ring buffer implementation

4796 ("HID: use debugfs for events/reports dumping") Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()") Signed-off-by: Vladis Dronov --- drivers/hid/hid-debug.c | 116 ++ include/linux/hid-debug.h | 9 ++- 2 files

Re: [PATCH] HID: debug: fix the ring buffer implementation

reaks the execution logic. > is kfifo_is_empty() == T really possible here? It looks like it is not. Reads are guarded by read_mutex and the only other code which touches hid_debug_fifo is writer. I will post v2 here soon. Lets see if it is ready for inclusion. Best regards, Vladis Dronov | R

[PATCH] HID: debug: fix the ring buffer implementation

dumping") Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()") Signed-off-by: Vladis Dronov --- drivers/hid/hid-debug.c | 116 ++ include/linux/hid-debug.h | 9 ++- 2 files changed, 47 insertions(+), 78 deletions(-) diff --g

Re: [PATCH 0/3] HID: debug: fix the ring buffer implementation

instead in a new one. Please, ignore this my patchset and I'll try to submit v2 soon. This also will answer to "how was it tested" concern, as I believe, kfifo was quite tested. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer - Original Message - &

[PATCH 2/3] HID: debug: provide reader-writer locking for the ring buffer

nder a spinlock. Signed-off-by: Vladis Dronov --- drivers/hid/hid-debug.c | 47 +++ include/linux/hid-debug.h | 1 + 2 files changed, 29 insertions(+), 19 deletions(-) diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index 20580871b0ec..e827784baf1a

[PATCH 3/3] HID: debug: fix the ring buffer writer implementation

calculations for the buffer pointers but only 2 or less memcpy() calls. Signed-off-by: Vladis Dronov --- drivers/hid/hid-debug.c | 66 - 1 file changed, 58 insertions(+), 8 deletions(-) diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index

[PATCH 0/3] HID: debug: fix the ring buffer implementation

/33d56e3870b67493cc867344aed2a062 Vladis Dronov (3): HID: debug: avoid infinite loop and corrupting data HID: debug: provide reader-writer locking for the ring buffer HID: debug: fix ring buffer implementation drivers/hid/hid-debug.c | 201 ++ include/linux/hid-debug.h | 1 + 2

[PATCH 1/3] HID: debug: avoid infinite loop and corrupting data

= 0. Fix this by properly handling this case and adding a check. Also, the function has "while (ret == 0)" loop which is not needed, remove it. Signed-off-by: Vladis Dronov --- drivers/hid/hid-debug.c | 109 1 file changed, 65 insertions(+), 44

Re: KMSAN: uninit-value in __dev_mc_add

a an ioctl. Surely, there can be something else which I do not see. Could anyone suggest an advice on this? Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer

Re: KMSAN: uninit-value in __dev_mc_add

tps://marc.info/?l=linux-netdev&m=153795423320016&w=2 A simplified reproducer is attached. Best regards, Vladis Dronov #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #incl

[PATCH] nl80211: check for the required netlink attributes presence

ng Signed-off-by: Vladis Dronov --- net/wireless/nl80211.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 0df8023..fbd5593 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -10903,6 +10903,9 @@ static int nl80211_set_

[PATCH] video: fbdev: aty: do not leak uninitialized padding in clk to userspace

'clk' is copied to a userland with padding byte(s) after 'vclk_post_div' field unitialized, leaking data from the stack. Fix this ensuring all of 'clk' is initialized to zero. References: https://github.com/torvalds/linux/pull/441 Reported-by: sohu0106 Signed-off-b

[PATCH] xfrm: policy: check policy direction value

cgi?id=1474928 Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)") Cc: # v2.6.21-rc1 Reported-by: "bo Zhang" Signed-off-by: Vladis Dronov --- net/xfrm/xfrm_policy.c | 6 ++ 1 file changed, 6 insertions(+) diff --git a/net/xfrm/xfrm_policy.

[PATCH v2] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

how_bug.cgi?id=1437431 Signed-off-by: Vladis Dronov --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index b445ce9..e0d7ff9 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_su

Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

ls > 0" or for "req->mip_levels >= 0" ? I glimpsed thru the code and I do not see problems with req->mip_levels being 0, surely I may be mistaking. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer - Original Message - From: "

Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

This flaw was assigned an id CVE-2017-7346 by MITRE: http://seclists.org/oss-sec/2017/q1/696 Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer - Original Message - From: "Vladis Dronov" To: "VMware Graphics" , "Sinclair Yeh" , &quo

[PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

how_bug.cgi?id=1437431 Signed-off-by: Vladis Dronov --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index b445ce9..b30824b 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_su

[PATCH] drm/vmwgfx: Check check that number of mip levels is above zero in vmw_surface_define_ioctl()

avoid this. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1435719 Signed-off-by: Vladis Dronov --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx

Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream()

From: Vladis Dronov Subject: [PATCH] ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and create_uaxx_quirk() functions allocate the audioformat object by themselves and free it upon error before

Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream()

es. Is the following rewrite acceptable for the next patch version? * if not, create a new pcm stream. Note, fp is added to the substream fmt_list * and will be freed on the chip instance release. Do not free fp or do remove * it from the substream fmt_list to avoid double-free. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer

Re: [PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream()

more straightforward. We need just to fix all the places where snd_usb_add_audio_stream() is called (3 as of now), please, have a look on the following patch. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer -- 8< -- From: Vladis Dronov Subject: [PATCH] ALSA: usb-audio: Fix

[PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream()

; > return err; > } > ... > snd_usb_init_substream(as, stream, fp); <<< ADDING fp > HERE > ... <<< IF > add_chmap() FAILS fp SHOULD > return add_chmap(pcm, stream, &as->substream[stream]); <<< BE > REMOVED FROM fmt_list > } add_chmap() itself does not add anything to fmt_list list, so we indeed need to remove only the single list element from the list. Having all the above in mind, the patch follows. 4.3) How to handle possible error paths after successful call to snd_usb_add_audio_stream() in create_fixed_stream_quirk() is d iscussable. Properly it should be like the below, but I believe it is overcomplication here would and stick to a simple error_after_add_audio_stream: label: > error2: > snd_usb_del_audio_stream(...something...); > error: > kfree(fp); > kfree(rate_table); > return err; Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer

[PATCH] ALSA: usb-audio: Fix double-free in snd_usb_add_audio_stream()

/show_bug.cgi?id=1283358 Reported-by: Ralf Spenneberg Signed-off-by: Vladis Dronov --- sound/usb/quirks.c | 17 - sound/usb/stream.c | 10 -- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index fb62bce..1d41b47 100644