March 2020 - Kernel - mailweb.openeuler.org

[PATCH 0/2] fixes CVE-2020-1749
by Yang Yingliang 16 Mar '20

16 Mar '20

1 2

[PATCH] openeuler/config: enable CONFIG_FCOE
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA The fcoe service failed to start because we did not enable CONFIG_FCOE just enable it. Link: https://gitee.com/open_euler/dashboard?issue_id=I1B9O9 Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3e0e9a3 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2124,7 +2124,7 @@ CONFIG_SCSI_SMARTPQI=m # CONFIG_SCSI_HPTIOP is not set CONFIG_LIBFC=m CONFIG_LIBFCOE=m -# CONFIG_FCOE is not set +CONFIG_FCOE=m # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set # CONFIG_SCSI_IPS is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f5579a2..4dd4540 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2181,7 +2181,7 @@ CONFIG_VMWARE_PVSCSI=m CONFIG_HYPERV_STORAGE=m CONFIG_LIBFC=m CONFIG_LIBFCOE=m -# CONFIG_FCOE is not set +CONFIG_FCOE=m CONFIG_FCOE_FNIC=m # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set -- 2.7.4

1 0

[PATCH hulk-4.19-next] openeuler/config: enable CONFIG_FCOE
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA The fcoe service failed to start because we did not enable CONFIG_FCOE just enable it. Link: https://gitee.com/open_euler/dashboard?issue_id=I1B9O9 Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3e0e9a3 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2124,7 +2124,7 @@ CONFIG_SCSI_SMARTPQI=m # CONFIG_SCSI_HPTIOP is not set CONFIG_LIBFC=m CONFIG_LIBFCOE=m -# CONFIG_FCOE is not set +CONFIG_FCOE=m # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set # CONFIG_SCSI_IPS is not set -- 2.7.4

1 0

[PATCH] openeuler/config: disable unused debug config
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA Two config option confirmations are not needed. CONFIG_VIDEO_ADV_DEBUG CONFIG_INFINIBAND_IPOIB_DEBUG So removed them from openeuler config Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3b94cfa 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -3693,7 +3693,7 @@ CONFIG_MEDIA_CONTROLLER=y CONFIG_VIDEO_DEV=m CONFIG_VIDEO_V4L2_SUBDEV_API=y CONFIG_VIDEO_V4L2=m -CONFIG_VIDEO_ADV_DEBUG=y +# CONFIG_VIDEO_ADV_DEBUG is not set CONFIG_VIDEO_FIXED_MINOR_RANGES=y # CONFIG_V4L2_FLASH_LED_CLASS is not set @@ -4630,7 +4630,7 @@ CONFIG_INFINIBAND_HNS_HIP08=m # CONFIG_INFINIBAND_HNS_TEST is not set CONFIG_INFINIBAND_IPOIB=m CONFIG_INFINIBAND_IPOIB_CM=y -CONFIG_INFINIBAND_IPOIB_DEBUG=y +# CONFIG_INFINIBAND_IPOIB_DEBUG is not set # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set CONFIG_INFINIBAND_SRP=m CONFIG_INFINIBAND_SRPT=m -- 2.7.4

1 0

[PATCH 0/4] update hns3 driver
by Yang Yingliang 14 Mar '20

14 Mar '20

shenhao (4): net: hns3: adds support for extended VLAN mode and 'QOS' in vlan 802.1Q protocol. net: hns3: Increase vlan tag0 when close the port_base_vlan net: hns3: add dumping vlan filter config in debugfs net: hns3: update the number of version drivers/net/ethernet/hisilicon/hns3/hnae3.h | 6 +- .../hisilicon/hns3/hns3_cae/hns3_cae_version.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 3 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 + .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 57 ++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 288 ++++++++++++++++----- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 11 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 9 - .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 5 + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- 13 files changed, 311 insertions(+), 80 deletions(-) -- 1.8.3

1 4

[PATCH hulk-4.19-next] openeuler/config: disable unused debug config
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA Two config option confirmations are not needed. CONFIG_VIDEO_ADV_DEBUG CONFIG_INFINIBAND_IPOIB_DEBUG So removed them from openeuler config Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3b94cfa 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -3693,7 +3693,7 @@ CONFIG_MEDIA_CONTROLLER=y CONFIG_VIDEO_DEV=m CONFIG_VIDEO_V4L2_SUBDEV_API=y CONFIG_VIDEO_V4L2=m -CONFIG_VIDEO_ADV_DEBUG=y +# CONFIG_VIDEO_ADV_DEBUG is not set CONFIG_VIDEO_FIXED_MINOR_RANGES=y # CONFIG_V4L2_FLASH_LED_CLASS is not set @@ -4630,7 +4630,7 @@ CONFIG_INFINIBAND_HNS_HIP08=m # CONFIG_INFINIBAND_HNS_TEST is not set CONFIG_INFINIBAND_IPOIB=m CONFIG_INFINIBAND_IPOIB_CM=y -CONFIG_INFINIBAND_IPOIB_DEBUG=y +# CONFIG_INFINIBAND_IPOIB_DEBUG is not set # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set CONFIG_INFINIBAND_SRP=m CONFIG_INFINIBAND_SRPT=m -- 2.7.4

1 0

[PATCH] net/hinic: driver code compliance rectification
by Yang Yingliang 12 Mar '20

12 Mar '20

From: Shaozhengchao <shaozhengchao(a)huawei.com> driver inclusion category:bugfix bugzilla:4472 CVE:NA ----------------------------------------------------------------------- hinic driver code compliance rectification. 1.Process return value of snprintf and sscanf function. 2.Modify devil number. Signed-off-by: Shaozhengchao <shaozhengchao(a)huawei.com> Reviewed-by: Luoshaokai <luoshaokai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../net/ethernet/huawei/hinic/hinic_dbgtool_knl.c | 4 +- drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 24 +++++++--- drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 56 +++++++++++++++++----- drivers/net/ethernet/huawei/hinic/hinic_hwdev.c | 53 ++++++++++++++------ drivers/net/ethernet/huawei/hinic/hinic_lld.c | 48 ++++++++++++++----- drivers/net/ethernet/huawei/hinic/hinic_main.c | 11 ++++- drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c | 8 +++- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 12 +++-- 8 files changed, 165 insertions(+), 51 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c index 1c9c469..535f41a 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c @@ -768,7 +768,7 @@ int dbgtool_knl_init(void *vhwdev, void *chip_node) sema_init(&dbgtool_info->dbgtool_sem, 1); ret = sscanf(chip_info->chip_name, HINIC_CHIP_NAME "%d", &id); - if (ret < 0) { + if (ret <= 0) { pr_err("Failed to get hinic id\n"); goto sscanf_chdev_fail; } @@ -874,7 +874,7 @@ void dbgtool_knl_deinit(void *vhwdev, void *chip_node) return; err = sscanf(chip_info->chip_name, HINIC_CHIP_NAME "%d", &id); - if (err < 0) + if (err <= 0) pr_err("Failed to get hinic id\n"); g_card_node_array[id] = NULL; diff --git a/drivers/net/ethernet/huawei/hinic/hinic_eqs.c b/drivers/net/ethernet/huawei/hinic/hinic_eqs.c index 4b2b0c0..3fee9fb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_eqs.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_eqs.c @@ -1133,15 +1133,27 @@ static int init_eq(struct hinic_eq *eq, struct hinic_hwdev *hwdev, u16 q_id, } if (type == HINIC_AEQ) { - snprintf(eq->irq_name, sizeof(eq->irq_name), - "hinic_aeq%d@pci:%s", eq->q_id, - pci_name(hwdev->pcidev_hdl)); + err = snprintf(eq->irq_name, sizeof(eq->irq_name), + "hinic_aeq%d@pci:%s", eq->q_id, + pci_name(hwdev->pcidev_hdl)); + if (err <= 0 || err >= (int)sizeof(eq->irq_name)) { + pr_err("Failed snprintf irq_name, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(eq->irq_name)); + err = -EINVAL; + goto req_irq_err; + } err = request_irq(entry->irq_id, aeq_interrupt, 0UL, eq->irq_name, eq); } else { - snprintf(eq->irq_name, sizeof(eq->irq_name), - "hinic_ceq%d@pci:%s", eq->q_id, - pci_name(hwdev->pcidev_hdl)); + err = snprintf(eq->irq_name, sizeof(eq->irq_name), + "hinic_ceq%d@pci:%s", eq->q_id, + pci_name(hwdev->pcidev_hdl)); + if (err <= 0 || err >= (int)sizeof(eq->irq_name)) { + pr_err("Failed snprintf irq_name, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(eq->irq_name)); + err = -EINVAL; + goto req_irq_err; + } err = request_irq(entry->irq_id, ceq_interrupt, 0UL, eq->irq_name, eq); } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c index 37d8d38..ac711da 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c @@ -294,12 +294,15 @@ u32 hinic_get_io_stats_size(struct hinic_nic_dev *nic_dev) } #define QUEUE_STATS_PACK(items, item_idx, array, stats_ptr, qid) { \ - int j; \ + int j, err; \ for (j = 0; j < ARRAY_LEN(array); j++) { \ memcpy((items)[item_idx].name, (array)[j].name, \ HINIC_SHOW_ITEM_LEN); \ - snprintf((items)[item_idx].name, HINIC_SHOW_ITEM_LEN, \ + err = snprintf((items)[item_idx].name, HINIC_SHOW_ITEM_LEN,\ (array)[j].name, (qid)); \ + if (err <= 0 || err >= HINIC_SHOW_ITEM_LEN) \ + pr_err("Failed snprintf: func_ret(%d), dest_len(%d)\n",\ + err, HINIC_SHOW_ITEM_LEN); \ (items)[item_idx].hexadecimal = 0; \ (items)[item_idx].value = \ GET_VALUE_OF_PTR((array)[j].size, \ @@ -335,6 +338,8 @@ void hinic_get_io_stats(struct hinic_nic_dev *nic_dev, #define LP_DEFAULT_TIME (5) /* seconds */ #define LP_PKT_LEN (1514) +#define OBJ_STR_MAX_LEN (32) +#define SET_LINK_STR_MAX_LEN (128) #define PORT_DOWN_ERR_IDX 0 enum diag_test_index { @@ -743,16 +748,28 @@ static int hinic_set_settings_to_hw(struct hinic_nic_dev *nic_dev, struct net_device *netdev = nic_dev->netdev; struct hinic_link_ksettings settings = {0}; enum nic_speed_level speed_level = 0; - char set_link_str[128] = {0}; + char set_link_str[SET_LINK_STR_MAX_LEN] = {0}; int err = 0; - snprintf(set_link_str, sizeof(set_link_str), "%s", - (set_settings & HILINK_LINK_SET_AUTONEG) ? - (autoneg ? "autong enable " : "autong disable ") : ""); + err = snprintf(set_link_str, sizeof(set_link_str), "%s", + (set_settings & HILINK_LINK_SET_AUTONEG) ? + (autoneg ? "autong enable " : "autong disable ") : ""); + if (err < 0 || err >= SET_LINK_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf link state, function return(%d) and dest_len(%d)\n", + err, SET_LINK_STR_MAX_LEN); + return -EFAULT; + } if (set_settings & HILINK_LINK_SET_SPEED) { speed_level = hinic_ethtool_to_hw_speed_level(speed); - snprintf(set_link_str, sizeof(set_link_str), - "%sspeed %d ", set_link_str, speed); + err = snprintf(set_link_str, sizeof(set_link_str), + "%sspeed %d ", set_link_str, speed); + if (err <= 0 || err >= SET_LINK_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf link speed, function return(%d) and dest_len(%d)\n", + err, SET_LINK_STR_MAX_LEN); + return -EFAULT; + } } settings.valid_bitmap = set_settings; @@ -883,7 +900,12 @@ static void hinic_get_drvinfo(struct net_device *netdev, return; } - snprintf(info->fw_version, sizeof(info->fw_version), "%s", mgmt_ver); + err = snprintf(info->fw_version, sizeof(info->fw_version), + "%s", mgmt_ver); + if (err <= 0 || err >= (int)sizeof(info->fw_version)) + nicif_err(nic_dev, drv, netdev, + "Failed snprintf fw_version, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(info->fw_version)); } static u32 hinic_get_msglevel(struct net_device *netdev) @@ -1429,10 +1451,22 @@ static int __hinic_set_coalesce(struct net_device *netdev, if (queue == COALESCE_ALL_QUEUE) { ori_intr_coal = &nic_dev->intr_coalesce[0]; - snprintf(obj_str, sizeof(obj_str), "for netdev"); + err = snprintf(obj_str, sizeof(obj_str), "for netdev"); + if (err <= 0 || err >= OBJ_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf string, function return(%d) and dest_len(%d)\n", + err, OBJ_STR_MAX_LEN); + return -EFAULT; + } } else { ori_intr_coal = &nic_dev->intr_coalesce[queue]; - snprintf(obj_str, sizeof(obj_str), "for queue %d", queue); + err = snprintf(obj_str, sizeof(obj_str), "for queue %d", queue); + if (err <= 0 || err >= OBJ_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf string, function return(%d) and dest_len(%d)\n", + err, OBJ_STR_MAX_LEN); + return -EFAULT; + } } CHECK_COALESCE_CHANGED(coal, rx_coalesce_usecs, COALESCE_TIMER_CFG_UNIT, ori_intr_coal->coalesce_timer_cfg, obj_str); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c index a31bb6c..c2454f6 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c @@ -519,6 +519,9 @@ static inline void __set_heartbeat_ehd_detect_delay(struct hinic_hwdev *hwdev, #define HINIC_QUEUE_MAX_DEPTH 12 #define HINIC_MAX_RX_BUFFER_SIZE 15 +#define CAP_INFO_MAC_LEN 512 +#define VENDOR_MAX_LEN 17 + static bool check_root_ctxt(struct hinic_hwdev *hwdev, u16 func_idx, void *buf_in, u16 in_size) { @@ -3891,6 +3894,7 @@ static void __print_cable_info(struct hinic_hwdev *hwdev, char tmp_vendor[17] = {0}; char *port_type = "Unknown port type"; int i; + int err = 0; if (info->cable_absent) { sdk_info(hwdev->dev_hdl, "Cable unpresent\n"); @@ -3918,24 +3922,45 @@ static void __print_cable_info(struct hinic_hwdev *hwdev, memcpy(tmp_vendor, info->vendor_name, sizeof(info->vendor_name)); - snprintf(tmp_str, sizeof(tmp_str) - 1, - "Vendor: %s, %s, length: %um, max_speed: %uGbps", - tmp_vendor, port_type, info->cable_length, - info->cable_max_speed); + err = snprintf(tmp_str, sizeof(tmp_str), + "Vendor: %s, %s, length: %um, max_speed: %uGbps", + tmp_vendor, port_type, info->cable_length, + info->cable_max_speed); + if (err <= 0 || err >= CAP_INFO_MAC_LEN) { + sdk_err(hwdev->dev_hdl, + "Failed snprintf cable vendor info, function return(%d) and dest_len(%d)\n", + err, CAP_INFO_MAC_LEN); + return; + } + if (info->port_type == LINK_PORT_FIBRE || info->port_type == LINK_PORT_AOC) { - snprintf(tmp_str, sizeof(tmp_str) - 1, - "%s, %s, Temperature: %u", tmp_str, - info->sfp_type ? "SFP" : "QSFP", info->cable_temp); + err = snprintf(tmp_str, sizeof(tmp_str), + "%s, %s, Temperature: %u", tmp_str, + info->sfp_type ? "SFP" : "QSFP", + info->cable_temp); + if (err <= 0 || err >= CAP_INFO_MAC_LEN) { + sdk_err(hwdev->dev_hdl, + "Failed snprintf cable Temp, function return(%d) and dest_len(%d)\n", + err, CAP_INFO_MAC_LEN); + return; + } + if (info->sfp_type) { - snprintf(tmp_str, sizeof(tmp_str) - 1, - "%s, rx power: %uuW, tx power: %uuW", - tmp_str, info->power[0], info->power[1]); + err = snprintf(tmp_str, sizeof(tmp_str), + "%s, rx power: %uuW, tx power: %uuW", + tmp_str, info->power[0], info->power[1]); } else { - snprintf(tmp_str, sizeof(tmp_str) - 1, - "%s, rx power: %uuw %uuW %uuW %uuW", - tmp_str, info->power[0], info->power[1], - info->power[2], info->power[3]); + err = snprintf(tmp_str, sizeof(tmp_str), + "%s, rx power: %uuw %uuW %uuW %uuW", + tmp_str, info->power[0], info->power[1], + info->power[2], info->power[3]); + } + if (err <= 0 || err >= CAP_INFO_MAC_LEN) { + sdk_err(hwdev->dev_hdl, + "Failed snprintf power info, function return(%d) and dest_len(%d)\n", + err, CAP_INFO_MAC_LEN); + return; } } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index 357e050..8a2f280 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -629,6 +629,7 @@ static void hinic_ignore_minor_version(char *version) { char ver_split[MAX_VER_SPLIT_NUM][MAX_VER_FIELD_LEN] = { {0} }; int max_ver_len, split_num = 0; + int err; __version_split(version, &split_num, ver_split); if (split_num != MAX_VER_SPLIT_NUM) @@ -637,8 +638,11 @@ static void hinic_ignore_minor_version(char *version) max_ver_len = (int)strlen(version) + 1; memset(version, 0, max_ver_len); - snprintf(version, max_ver_len, "%s.%s.%s.0", - ver_split[0], ver_split[1], ver_split[2]); + err = snprintf(version, max_ver_len, "%s.%s.%s.0", + ver_split[0], ver_split[1], ver_split[2]); + if (err <= 0 || err >= max_ver_len) + pr_err("Failed snprintf version, function return(%d) and dest_len(%d)\n", + err, max_ver_len); } static int hinic_detect_version_compatible(struct hinic_pcidev *pcidev) @@ -1152,7 +1156,7 @@ void hinic_get_all_chip_id(void *id_info) lld_dev_hold(); list_for_each_entry(chip_node, &g_hinic_chip_list, node) { err = sscanf(chip_node->chip_name, HINIC_CHIP_NAME "%d", &id); - if (err < 0) + if (err <= 0) pr_err("Failed to get hinic id\n"); card_id->id[i] = id; @@ -1895,6 +1899,7 @@ static int alloc_chip_node(struct hinic_pcidev *pci_adapter) struct card_node *chip_node; unsigned char i; unsigned char parent_bus_number = 0; + int err; if (!pci_is_root_bus(pci_adapter->pcidev->bus)) parent_bus_number = pci_adapter->pcidev->bus->parent->number; @@ -1931,27 +1936,39 @@ static int alloc_chip_node(struct hinic_pcidev *pci_adapter) chip_node = kzalloc(sizeof(*chip_node), GFP_KERNEL); if (!chip_node) { - card_bit_map = CLEAR_BIT(card_bit_map, i); sdk_err(&pci_adapter->pcidev->dev, "Failed to alloc chip node\n"); - return -ENOMEM; + goto alloc_chip_err; } chip_node->dbgtool_attr_file.name = kzalloc(IFNAMSIZ, GFP_KERNEL); if (!(chip_node->dbgtool_attr_file.name)) { - kfree(chip_node); - card_bit_map = CLEAR_BIT(card_bit_map, i); sdk_err(&pci_adapter->pcidev->dev, "Failed to alloc dbgtool attr file name\n"); - return -ENOMEM; + goto alloc_dbgtool_attr_file_err; } /* parent bus number */ chip_node->dp_bus_num = parent_bus_number; - snprintf(chip_node->chip_name, IFNAMSIZ, "%s%d", HINIC_CHIP_NAME, i); - snprintf((char *)chip_node->dbgtool_attr_file.name, - IFNAMSIZ, "%s%d", HINIC_CHIP_NAME, i); + err = snprintf(chip_node->chip_name, IFNAMSIZ, "%s%d", + HINIC_CHIP_NAME, i); + if (err <= 0 || err >= IFNAMSIZ) { + sdk_err(&pci_adapter->pcidev->dev, + "Failed snprintf chip_name, function return(%d) and dest_len(%d)\n", + err, IFNAMSIZ); + goto alloc_dbgtool_attr_file_err; + } + + err = snprintf((char *)chip_node->dbgtool_attr_file.name, + IFNAMSIZ, "%s%d", HINIC_CHIP_NAME, i); + if (err <= 0 || err >= IFNAMSIZ) { + sdk_err(&pci_adapter->pcidev->dev, + "Failed snprintf dbgtool_attr_file_name, function return(%d) and dest_len(%d)\n", + err, IFNAMSIZ); + goto alloc_dbgtool_attr_file_err; + } + sdk_info(&pci_adapter->pcidev->dev, "Add new chip %s to global list succeed\n", chip_node->chip_name); @@ -1962,6 +1979,13 @@ static int alloc_chip_node(struct hinic_pcidev *pci_adapter) pci_adapter->chip_node = chip_node; return 0; + +alloc_dbgtool_attr_file_err: + kfree(chip_node); + +alloc_chip_err: + card_bit_map = CLEAR_BIT(card_bit_map, i); + return -ENOMEM; } static void free_chip_node(struct hinic_pcidev *pci_adapter) @@ -1976,7 +2000,7 @@ static void free_chip_node(struct hinic_pcidev *pci_adapter) "Delete chip %s from global list succeed\n", chip_node->chip_name); err = sscanf(chip_node->chip_name, HINIC_CHIP_NAME "%u", &id); - if (err < 0) + if (err <= 0) sdk_err(&pci_adapter->pcidev->dev, "Failed to get hinic id\n"); card_bit_map = CLEAR_BIT(card_bit_map, id); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index 5960603..9b53a6f 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -750,8 +750,15 @@ static int hinic_qps_irq_init(struct hinic_nic_dev *nic_dev) cpumask_set_cpu(local_cpu, &irq_cfg->affinity_mask); } - snprintf(irq_cfg->irq_name, sizeof(irq_cfg->irq_name), - "%s_qp%d", nic_dev->netdev->name, q_id); + err = snprintf(irq_cfg->irq_name, sizeof(irq_cfg->irq_name), + "%s_qp%d", nic_dev->netdev->name, q_id); + if (err <= 0 || err >= (int)sizeof(irq_cfg->irq_name)) { + nic_err(&pdev->dev, + "Failed snprintf irq_name, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(irq_cfg->irq_name)); + goto req_tx_irq_err; + } + err = hinic_request_irq(irq_cfg, q_id); if (err) { nicif_err(nic_dev, drv, nic_dev->netdev, "Failed to request Rx irq\n"); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c index 8d89d30..cac0cdb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c @@ -2175,7 +2175,13 @@ int hinic_get_mgmt_version(void *hwdev, u8 *mgmt_ver) return -EINVAL; } - snprintf(mgmt_ver, HINIC_MGMT_VERSION_MAX_LEN, "%s", up_ver.ver); + err = snprintf(mgmt_ver, HINIC_MGMT_VERSION_MAX_LEN, "%s", up_ver.ver); + if (err <= 0 || err >= HINIC_MGMT_VERSION_MAX_LEN) { + nic_err(dev->dev_hdl, + "Failed snprintf fw version, function return(%d) and dest_len(%d)\n", + err, HINIC_MGMT_VERSION_MAX_LEN); + return -EINVAL; + } return 0; } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 9a2cb00..46dd9ec 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -1179,14 +1179,20 @@ static int get_drv_version(void *hwdev, void *buf_in, u32 in_size, { struct drv_version_info *ver_info; char ver_str[MAX_VER_INFO_LEN] = {0}; + int err; if (*out_size != sizeof(*ver_info)) { pr_err("Unexpect out buf size from user :%d, expect: %lu\n", *out_size, sizeof(*ver_info)); return -EFAULT; } - snprintf(ver_str, sizeof(ver_str), "%s [compiled with the kernel]", - HINIC_DRV_VERSION); + err = snprintf(ver_str, sizeof(ver_str), + "%s [compiled with the kernel]", HINIC_DRV_VERSION); + if (err <= 0 || err >= MAX_VER_INFO_LEN) { + pr_err("Failed snprintf driver version, function return(%d) and dest_len(%d)\n", + err, MAX_VER_INFO_LEN); + return -EFAULT; + } ver_info = (struct drv_version_info *)buf_out; memcpy(ver_info->ver, ver_str, sizeof(ver_str)); @@ -1420,7 +1426,7 @@ static int get_card_func_info(char *dev_name, struct msg_module *nt_msg) } err = sscanf(dev_name, HINIC_CHIP_NAME "%d", &id); - if (err < 0) { + if (err <= 0) { pr_err("Failed to get hinic id\n"); return err; } -- 1.8.3

1 0

[PATCH 0/3] update hinic and hns3 driver
by Yang Yingliang 12 Mar '20

12 Mar '20

Shaozhengchao (1): net/hinic: Solve the problem that the network card hangs when receiving the skb which frag_size=0 Shengzui You (2): net: hns3: update hns3 version to 1.9.37.1 net: hns3: adds support for reading module eeprom info drivers/net/ethernet/hisilicon/hns3/hnae3.h | 6 +- .../hisilicon/hns3/hns3_cae/hns3_cae_version.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 79 ++++++++++++++++ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 15 +++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 102 +++++++++++++++++++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- drivers/net/ethernet/hisilicon/hns3/kcompat.h | 10 ++ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 1 + drivers/net/ethernet/huawei/hinic/hinic_tx.c | 65 ++++++++++--- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 2 + 12 files changed, 269 insertions(+), 19 deletions(-) -- 1.8.3

1 3

[PATCH 0/5] fixes some CVE and bug
by Yang Yingliang 12 Mar '20

12 Mar '20

Cengiz Can (1): blktrace: fix dereference after null check Jan Kara (1): blktrace: Protect q->blk_trace with RCU Qu Wenruo (1): btrfs: tree-checker: Remove comprehensive root owner check Zhang Xiaoxu (1): vgacon: Fix a UAF in vgacon_invert_region Zheng Bin (1): xfs: add agf freeblocks verify in xfs_agf_verify drivers/video/console/vgacon.c | 3 ++ fs/btrfs/tree-checker.c | 24 --------- fs/xfs/libxfs/xfs_alloc.c | 16 ++++++ include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 18 +++++-- kernel/trace/blktrace.c | 120 ++++++++++++++++++++++++++++++----------- 6 files changed, 122 insertions(+), 61 deletions(-) -- 1.8.3

1 5

[PATCH] vgacon: Fix a UAF in vgacon_invert_region
by Yang Yingliang 11 Mar '20

11 Mar '20

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v5.6-rc4 commit 513dc792d6060d5ef572e43852683097a8420f56 category: bugfix bugzilla: 13690 CVE: CVE-2020-8647, CVE-2020-8649 ------------------------------------------------- When syzkaller tests, there is a UAF: BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr ffff880000100000 Read of size 2 by task syz-executor.1/16489 page:ffffea0000004000 count:0 mapcount:-127 mapping: (null) index:0x0 page flags: 0xfffff00000000() page dumped because: kasan: bad access detected CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 Call Trace: [<ffffffffb119f309>] dump_stack+0x1e/0x20 [<ffffffffb04af957>] kasan_report+0x577/0x950 [<ffffffffb04ae652>] __asan_load2+0x62/0x80 [<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110 [<ffffffffb0a39d95>] invert_screen+0xe5/0x470 [<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0 [<ffffffffb0a3bfae>] tioclinux+0xee/0x490 [<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670 [<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10 [<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40 [<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170 [<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27 Memory state around the buggy address: ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff It can be reproduce in the linux mainline by the program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <linux/vt.h> struct tiocl_selection { unsigned short xs; /* X start */ unsigned short ys; /* Y start */ unsigned short xe; /* X end */ unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */ }; #define TIOCL_SETSEL 2 struct tiocl { unsigned char type; unsigned char pad; struct tiocl_selection sel; }; int main() { int fd = 0; const char *dev = "/dev/char/4:1"; struct vt_consize v = {0}; struct tiocl tioc = {0}; fd = open(dev, O_RDWR, 0); v.v_rows = 3346; ioctl(fd, VT_RESIZEX, &v); tioc.type = TIOCL_SETSEL; ioctl(fd, TIOCLINUX, &tioc); return 0; } When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_size in vgacon driver, then bad access. Also, if set an larger screenbuf firstly, then set an more larger screenbuf, when copy old_origin to new_origin, a bad access may happen. So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 and CVE-2020-8647. Linus pointed out that overflow checking seems absent. We're saved by the existing bounds checks in vc_do_resize() with rather strict limits: if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL; Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix") Reference: CVE-2020-8647 and CVE-2020-8649 Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> [danvet: augment commit message to point out overflow safety] Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangx… Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/console/vgacon.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index c6b3bdb..bfaa9ec 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -1316,6 +1316,9 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font) static int vgacon_resize(struct vc_data *c, unsigned int width, unsigned int height, unsigned int user) { + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + if (width % 2 || width > screen_info.orig_video_cols || height > (screen_info.orig_video_lines * vga_default_font_height)/ c->vc_font.height) -- 1.8.3

1 0

[PATCH] can, slip: Protect tty->disc_data in write_wakeup and close with RCU
by Yang Yingliang 10 Mar '20

10 Mar '20

From: Richard Palethorpe <rpalethorpe(a)suse.com> [ Upstream commit 0ace17d56824165c7f4c68785d6b58971db954dd ] write_wakeup can happen in parallel with close/hangup where tty->disc_data is set to NULL and the netdevice is freed thus also freeing disc_data. write_wakeup accesses disc_data so we must prevent close from freeing the netdev while write_wakeup has a non-NULL view of tty->disc_data. We also need to make sure that accesses to disc_data are atomic. Which can all be done with RCU. This problem was found by Syzkaller on SLCAN, but the same issue is reproducible with the SLIP line discipline using an LTP test based on the Syzkaller reproducer. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a(a)syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe <rpalethorpe(a)suse.com> Cc: Wolfgang Grandegger <wg(a)grandegger.com> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Tyler Hall <tylerwhall(a)gmail.com> Cc: linux-can(a)vger.kernel.org Cc: netdev(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Cc: syzkaller(a)googlegroups.com Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/can/slcan.c | 12 ++++++++++-- drivers/net/slip/slip.c | 12 ++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index cf0769a..b2e5bca 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -343,9 +343,16 @@ static void slcan_transmit(struct work_struct *work) */ static void slcan_write_wakeup(struct tty_struct *tty) { - struct slcan *sl = tty->disc_data; + struct slcan *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } /* Send a can_frame to a TTY queue. */ @@ -640,10 +647,11 @@ static void slcan_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* Flush network side */ diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 77207f9..93f303e 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -452,9 +452,16 @@ static void slip_transmit(struct work_struct *work) */ static void slip_write_wakeup(struct tty_struct *tty) { - struct slip *sl = tty->disc_data; + struct slip *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } static void sl_tx_timeout(struct net_device *dev) @@ -882,10 +889,11 @@ static void slip_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* VSV = very important to remove timers */ -- 1.8.3

1 0

[PATCH] relay: handle alloc_percpu returning NULL in relay_open
by Yang Yingliang 10 Mar '20

10 Mar '20

hulk inclusion category: bugfix bugzilla: 13690 CVE: CVE-2019-19462 ------------------------------------------------- alloc_percpu() may return NULL, which means chan->buf may be set to NULL. In that case, when we do *per_cpu_ptr(chan->buf, ...), we dereference an invalid pointer: BUG: Unable to handle kernel data access at 0x7dae0000 Faulting instruction address: 0xc0000000003f3fec ... NIP [c0000000003f3fec] relay_open+0x29c/0x600 LR [c0000000003f3fc0] relay_open+0x270/0x600 Call Trace: [c000000054353a70] [c0000000003f3fb4] relay_open+0x264/0x600 (unreliable) [c000000054353b00] [c000000000451764] __blk_trace_setup+0x254/0x600 [c000000054353bb0] [c000000000451b78] blk_trace_setup+0x68/0xa0 [c000000054353c10] [c0000000010da77c] sg_ioctl+0x7bc/0x2e80 [c000000054353cd0] [c000000000758cbc] do_vfs_ioctl+0x13c/0x1300 [c000000054353d90] [c000000000759f14] ksys_ioctl+0x94/0x130 [c000000054353de0] [c000000000759ff8] sys_ioctl+0x48/0xb0 [c000000054353e20] [c00000000000bcd0] system_call+0x5c/0x68 Check if alloc_percpu returns NULL. This was found by syzkaller both on x86 and powerpc, and the reproducer it found on powerpc is capable of hitting the issue as an unprivileged user. https://lore.kernel.org/lkml/20191219121256.26480-1-dja%40axtens.net/ Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/relay.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/relay.c b/kernel/relay.c index 9e0f523..078f733 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -581,6 +581,10 @@ struct rchan *relay_open(const char *base_filename, return NULL; chan->buf = alloc_percpu(struct rchan_buf *); + if (!chan->buf) { + kfree(chan); + return NULL; + } chan->version = RELAYFS_CHANNEL_VERSION; chan->n_subbufs = n_subbufs; chan->subbuf_size = subbuf_size; -- 1.8.3

1 0

[PATCH] drm/radeon: check the alloc_workqueue return value
by Yang Yingliang 10 Mar '20

10 Mar '20

hulk inclusion category: bugfix bugzilla: 13690 CVE: CVE-2019-16230 ------------------------------------------------- check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c index d8e2d7b..09522b9 100644 --- a/drivers/gpu/drm/radeon/radeon_display.c +++ b/drivers/gpu/drm/radeon/radeon_display.c @@ -672,11 +672,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index) if (radeon_crtc == NULL) return; + radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); + if (!radeon_crtc->flip_queue) { + kfree(radeon_crtc); + return; + } + drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs); drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256); radeon_crtc->crtc_id = index; - radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); rdev->mode_info.crtcs[index] = radeon_crtc; if (rdev->family >= CHIP_BONAIRE) { -- 1.8.3

1 0

[PATCH] apparmor: Fix use-after-free in aa_audit_rule_init
by Yang Yingliang 10 Mar '20

10 Mar '20

From: Navid Emamdoost <navid.emamdoost(a)gmail.com> hulk inclusion category: bugfix bugzilla: NA CVE: CVE-2019-18814 --------------------------- In the implementation of aa_audit_rule_init(), when aa_label_parse() fails the allocated memory for rule is released using aa_audit_rule_free(). But after this release, the return statement tries to access the label field of the rule which results in use-after-free. Before releasing the rule, copy errNo and return it after release. Fixes: 52e8c38001d8 ("apparmor: Fix memory leak of rule on error exit path") Signed-off-by: Navid Emamdoost <navid.emamdoost(a)gmail.com> Reviewed-by: Tyler Hicks <tyhicks(a)canonical.com> Signed-off-by: Jason Yan <yanaijie(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- security/apparmor/audit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c index eeaddfe..70b9730 100644 --- a/security/apparmor/audit.c +++ b/security/apparmor/audit.c @@ -201,8 +201,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr, GFP_KERNEL, true, false); if (IS_ERR(rule->label)) { + int err = PTR_ERR(rule->label); aa_audit_rule_free(rule); - return PTR_ERR(rule->label); + return err; } *vrule = rule; -- 1.8.3

1 0

[PATCH] can, slip: Protect tty->disc_data in write_wakeup and close with RCU
by Xiongfeng Wang 09 Mar '20

09 Mar '20

From: Richard Palethorpe <rpalethorpe(a)suse.com> [ Upstream commit 0ace17d56824165c7f4c68785d6b58971db954dd ] write_wakeup can happen in parallel with close/hangup where tty->disc_data is set to NULL and the netdevice is freed thus also freeing disc_data. write_wakeup accesses disc_data so we must prevent close from freeing the netdev while write_wakeup has a non-NULL view of tty->disc_data. We also need to make sure that accesses to disc_data are atomic. Which can all be done with RCU. This problem was found by Syzkaller on SLCAN, but the same issue is reproducible with the SLIP line discipline using an LTP test based on the Syzkaller reproducer. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a(a)syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe <rpalethorpe(a)suse.com> Cc: Wolfgang Grandegger <wg(a)grandegger.com> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Tyler Hall <tylerwhall(a)gmail.com> Cc: linux-can(a)vger.kernel.org Cc: netdev(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Cc: syzkaller(a)googlegroups.com Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/net/can/slcan.c | 12 ++++++++++-- drivers/net/slip/slip.c | 12 ++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index cf0769a..b2e5bca 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -343,9 +343,16 @@ static void slcan_transmit(struct work_struct *work) */ static void slcan_write_wakeup(struct tty_struct *tty) { - struct slcan *sl = tty->disc_data; + struct slcan *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } /* Send a can_frame to a TTY queue. */ @@ -640,10 +647,11 @@ static void slcan_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* Flush network side */ diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 77207f9..93f303e 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -452,9 +452,16 @@ static void slip_transmit(struct work_struct *work) */ static void slip_write_wakeup(struct tty_struct *tty) { - struct slip *sl = tty->disc_data; + struct slip *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } static void sl_tx_timeout(struct net_device *dev) @@ -882,10 +889,11 @@ static void slip_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* VSV = very important to remove timers */ -- 1.7.12.4

1 0

[PATCH 0/5] livepatch without ftrace for x86_64
by Yang Yingliang 03 Mar '20

03 Mar '20

Cheng Jian (5): livepatch/x86: support livepatch without ftrace livepatch/x86: check active func in consistency stack checking livepatch/arm64: check active func in consistency stack checking livepatch/x86: enable livepatch config for hulk livepatch/x86: enable livepatch config openeuler arch/arm64/kernel/livepatch.c | 84 ++++++---- arch/x86/Kconfig | 1 + arch/x86/configs/hulk_defconfig | 54 +++--- arch/x86/configs/openeuler_defconfig | 18 +- arch/x86/configs/syzkaller_defconfig | 53 +++--- arch/x86/include/asm/livepatch.h | 33 +++- arch/x86/kernel/livepatch.c | 307 +++++++++++++++++++++++++++++++++++ kernel/livepatch/core.c | 13 ++ 8 files changed, 492 insertions(+), 71 deletions(-) -- 1.8.3

1 5

[PATCH 0/5] livepatch without ftrace for x86_64
by Yang Yingliang 03 Mar '20

03 Mar '20

Cheng Jian (5): livepatch/x86: support livepatch without ftrace livepatch/x86: check active func in consistency stack checking livepatch/arm64: check active func in consistency stack checking livepatch/x86: enable livepatch config for hulk livepatch/x86: enable livepatch config openeuler arch/arm64/kernel/livepatch.c | 84 ++++++---- arch/x86/Kconfig | 1 + arch/x86/configs/hulk_defconfig | 54 +++--- arch/x86/configs/openeuler_defconfig | 18 +- arch/x86/configs/syzkaller_defconfig | 53 +++--- arch/x86/include/asm/livepatch.h | 33 +++- arch/x86/kernel/livepatch.c | 307 +++++++++++++++++++++++++++++++++++ kernel/livepatch/core.c | 13 ++ 8 files changed, 492 insertions(+), 71 deletions(-) -- 1.8.3

1 0

[PATCH 0/3] fixes CVE-2020-2732
by Yang Yingliang 03 Mar '20

03 Mar '20

Oliver Upton (2): KVM: nVMX: Refactor IO bitmap checks into helper function KVM: nVMX: Check IO instruction VM-exit conditions Paolo Bonzini (1): KVM: nVMX: Don't emulate instructions in guest mode arch/x86/kvm/vmx.c | 99 +++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 79 insertions(+), 20 deletions(-) -- 1.8.3

1 3

[PATCH] floppy: check FDC index for errors before assigning it
by Yang Yingliang 03 Mar '20

03 Mar '20

From: Linus Torvalds <torvalds(a)linux-foundation.org> commit 2e90ca68b0d2f5548804f22f0dd61145516171e3 upstream. Jordy Zomer reported a KASAN out-of-bounds read in the floppy driver in wait_til_ready(). Which on the face of it can't happen, since as Willy Tarreau points out, the function does no particular memory access. Except through the FDCS macro, which just indexes a static allocation through teh current fdc, which is always checked against N_FDC. Except the checking happens after we've already assigned the value. The floppy driver is a disgrace (a lot of it going back to my original horrd "design"), and has no real maintainer. Nobody has the hardware, and nobody really cares. But it still gets used in virtual environment because it's one of those things that everybody supports. The whole thing should be re-written, or at least parts of it should be seriously cleaned up. The 'current fdc' index, which is used by the FDCS macro, and which is often shadowed by a local 'fdc' variable, is a prime example of how not to write code. But because nobody has the hardware or the motivation, let's just fix up the immediate problem with a nasty band-aid: test the fdc index before actually assigning it to the static 'fdc' variable. Reported-by: Jordy Zomer <jordy(a)simplyhacker.com> Cc: Willy Tarreau <w(a)1wt.eu> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/floppy.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index e71589e..bf222c4 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -852,14 +852,17 @@ static void reset_fdc_info(int mode) /* selects the fdc and drive, and enables the fdc's input/dma. */ static void set_fdc(int drive) { + unsigned int new_fdc = fdc; + if (drive >= 0 && drive < N_DRIVE) { - fdc = FDC(drive); + new_fdc = FDC(drive); current_drive = drive; } - if (fdc != 1 && fdc != 0) { + if (new_fdc >= N_FDC) { pr_info("bad fdc value\n"); return; } + fdc = new_fdc; set_dor(fdc, ~0, 8); #if N_FDC > 1 set_dor(1 - fdc, ~8, 0); -- 1.8.3

1 0