October 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] scsi: stex: Properly zero out the passthrough command structure
by Yongqiang Liu 31 Oct '22

31 Oct '22

From: Linus Torvalds <torvalds(a)linux-foundation.org> stable inclusion from stable-v4.19.262 commit a99c5e38dc6c3dc3da28489b78db09a4b9ffc8c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5ROPX CVE: CVE-2022-40768 ------------------------------- commit 6022f210461fef67e6e676fd8544ca02d1bcfa7a upstream. The passthrough structure is declared off of the stack, so it needs to be set to zero before copied back to userspace to prevent any unintentional data leakage. Switch things to be statically allocated which will fill the unused fields with 0 automatically. Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com Cc: stable(a)kernel.org Cc: "James E.J. Bottomley" <jejb(a)linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen(a)oracle.com> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Reported-by: hdthky <hdthky0(a)gmail.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: GONG Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/stex.c | 17 +++++++++-------- include/scsi/scsi_cmnd.h | 2 +- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c index 9b20643ab49d..124a5d0ec05c 100644 --- a/drivers/scsi/stex.c +++ b/drivers/scsi/stex.c @@ -673,16 +673,17 @@ stex_queuecommand_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *)) return 0; case PASSTHRU_CMD: if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) { - struct st_drvver ver; + const struct st_drvver ver = { + .major = ST_VER_MAJOR, + .minor = ST_VER_MINOR, + .oem = ST_OEM, + .build = ST_BUILD_VER, + .signature[0] = PASSTHRU_SIGNATURE, + .console_id = host->max_id - 1, + .host_no = hba->host->host_no, + }; size_t cp_len = sizeof(ver); - ver.major = ST_VER_MAJOR; - ver.minor = ST_VER_MINOR; - ver.oem = ST_OEM; - ver.build = ST_BUILD_VER; - ver.signature[0] = PASSTHRU_SIGNATURE; - ver.console_id = host->max_id - 1; - ver.host_no = hba->host->host_no; cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len); cmd->result = sizeof(ver) == cp_len ? DID_OK << 16 | COMMAND_COMPLETE << 8 : diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h index 4c47157c01cc..d5ead17c9252 100644 --- a/include/scsi/scsi_cmnd.h +++ b/include/scsi/scsi_cmnd.h @@ -233,7 +233,7 @@ static inline struct scsi_data_buffer *scsi_out(struct scsi_cmnd *cmd) } static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd, - void *buf, int buflen) + const void *buf, int buflen) { return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd), buf, buflen); -- 2.25.1

1 0

[Cancel] openEuler Kernel SIG双周例会
by openEuler conference 31 Oct '22

31 Oct '22

Sorry! The Zoom meeting will be held at 2022-11-04 14:00 scheduled by openEuler Kernel SIG has been cancelled.

1 0

openEuler Kernel SIG双周例会
by openEuler conference 31 Oct '22

31 Oct '22

您好！ Kernel SIG 邀请您参加 2022-11-04 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题~ 会议链接：https://us06web.zoom.us/j/88363936462?pwd=MEpPRWZKWFd2ejFWalNQQythd1JSdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-11-04 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题~ You can join the meeting at https://us06web.zoom.us/j/88363936462?pwd=MEpPRWZKWFd2ejFWalNQQythd1JSdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nilfs2: fix leak of nilfs_root in case of writer thread creation failure
by Yongqiang Liu 29 Oct '22

29 Oct '22

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.1-rc1 commit d0d51a97063db4704a5ef6bc978dddab1636a306 category: bugfix bugzilla: 187884, https://gitee.com/src-openeuler/kernel/issues/I5X2OB CVE: CVE-2022-3646 -------------------------------- If nilfs_attach_log_writer() failed to create a log writer thread, it frees a data structure of the log writer without any cleanup. After commit e912a5b66837 ("nilfs2: use root object to get ifile"), this causes a leak of struct nilfs_root, which started to leak an ifile metadata inode and a kobject on that struct. In addition, if the kernel is booted with panic_on_warn, the above ifile metadata inode leak will cause the following panic when the nilfs2 kernel module is removed: kmem_cache_destroy nilfs2_inode_cache: Slab cache still has objects when called from nilfs_destroy_cachep+0x16/0x3a [nilfs2] WARNING: CPU: 8 PID: 1464 at mm/slab_common.c:494 kmem_cache_destroy+0x138/0x140 ... RIP: 0010:kmem_cache_destroy+0x138/0x140 Code: 00 20 00 00 e8 a9 55 d8 ff e9 76 ff ff ff 48 8b 53 60 48 c7 c6 20 70 65 86 48 c7 c7 d8 69 9c 86 48 8b 4c 24 28 e8 ef 71 c7 00 <0f> 0b e9 53 ff ff ff c3 48 81 ff ff 0f 00 00 77 03 31 c0 c3 53 48 ... Call Trace: <TASK> ? nilfs_palloc_freev.cold.24+0x58/0x58 [nilfs2] nilfs_destroy_cachep+0x16/0x3a [nilfs2] exit_nilfs_fs+0xa/0x1b [nilfs2] __x64_sys_delete_module+0x1d9/0x3a0 ? __sanitizer_cov_trace_pc+0x1a/0x50 ? syscall_trace_enter.isra.19+0x119/0x190 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK> Kernel panic - not syncing: panic_on_warn set ... This patch fixes these issues by calling nilfs_detach_log_writer() cleanup function if spawning the log writer thread fails. Link: https://lkml.kernel.org/r/20221007085226.57667-1-konishi.ryusuke@gmail.com Fixes: e912a5b66837 ("nilfs2: use root object to get ifile") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+7381dc4ad60658ca4c05(a)syzkaller.appspotmail.com Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflict: fs/nilfs2/segment.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/nilfs2/segment.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 445eef41bfaf..2104be29417b 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -2781,10 +2781,9 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root) return -ENOMEM; err = nilfs_segctor_start_thread(nilfs->ns_writer); - if (err) { - kfree(nilfs->ns_writer); - nilfs->ns_writer = NULL; - } + if (unlikely(err)) + nilfs_detach_log_writer(sb); + return err; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] vsock: Fix memory leak in vsock_connect()
by Yongqiang Liu 29 Oct '22

29 Oct '22

From: Peilin Ye <peilin.ye(a)bytedance.com> stable inclusion from stable-v4.19.256 commit 2fc2a7767f661e6083f69588718cdf6f07cb9330 category: bugfix bugzilla: 187891, https://gitee.com/src-openeuler/kernel/issues/I5WYLL CVE: CVE-2022-3629 -------------------------------- commit 7e97cfed9929eaabc41829c395eb0d1350fccb9d upstream. An O_NONBLOCK vsock_connect() request may try to reschedule @connect_work. Imagine the following sequence of vsock_connect() requests: 1. The 1st, non-blocking request schedules @connect_work, which will expire after 200 jiffies. Socket state is now SS_CONNECTING; 2. Later, the 2nd, blocking request gets interrupted by a signal after a few jiffies while waiting for the connection to be established. Socket state is back to SS_UNCONNECTED, but @connect_work is still pending, and will expire after 100 jiffies. 3. Now, the 3rd, non-blocking request tries to schedule @connect_work again. Since @connect_work is already scheduled, schedule_delayed_work() silently returns. sock_hold() is called twice, but sock_put() will only be called once in vsock_connect_timeout(), causing a memory leak reported by syzbot: BUG: memory leak unreferenced object 0xffff88810ea56a40 (size 1232): comm "syz-executor756", pid 3604, jiffies 4294947681 (age 12.350s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 28 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 (..@............ backtrace: [<ffffffff837c830e>] sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:1930 [<ffffffff837cbe22>] sk_alloc+0x32/0x2e0 net/core/sock.c:1989 [<ffffffff842ccf68>] __vsock_create.constprop.0+0x38/0x320 net/vmw_vsock/af_vsock.c:734 [<ffffffff842ce8f1>] vsock_create+0xc1/0x2d0 net/vmw_vsock/af_vsock.c:2203 [<ffffffff837c0cbb>] __sock_create+0x1ab/0x2b0 net/socket.c:1468 [<ffffffff837c3acf>] sock_create net/socket.c:1519 [inline] [<ffffffff837c3acf>] __sys_socket+0x6f/0x140 net/socket.c:1561 [<ffffffff837c3bba>] __do_sys_socket net/socket.c:1570 [inline] [<ffffffff837c3bba>] __se_sys_socket net/socket.c:1568 [inline] [<ffffffff837c3bba>] __x64_sys_socket+0x1a/0x20 net/socket.c:1568 [<ffffffff84512815>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84512815>] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae <...> Use mod_delayed_work() instead: if @connect_work is already scheduled, reschedule it, and undo sock_hold() to keep the reference count balanced. Reported-and-tested-by: syzbot+b03f55bf128f9a38f064(a)syzkaller.appspotmail.com Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Co-developed-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Peilin Ye <peilin.ye(a)bytedance.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 4f9a0635d723..ed715ccca9a9 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1213,7 +1213,14 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, * timeout fires. */ sock_hold(sk); - schedule_delayed_work(&vsk->connect_work, timeout); + + /* If the timeout function is already scheduled, + * reschedule it, then ungrab the socket refcount to + * keep it balanced. + */ + if (mod_delayed_work(system_wq, &vsk->connect_work, + timeout)) + sock_put(sk); /* Skip ahead to preserve error code set above. */ goto out_wait; -- 2.25.1

1 0

[PATCH OLK-5.10 00/39] sharepool: Update patches from hulk
by Wang Wensheng 28 Oct '22

28 Oct '22

This patch set contains code optimizations and bugfixes for the sharepool. Chen Jun (5): sharepool: Make the definitions of MMAP_SHARE_POOL_{START|16G_START} more readable sharepool: Rename sp_mapping.flag to sp_mapping.type sharepool: replace spg->{dvpp|normal} with spg->mapping[SP_MAPPING_{DVPP|NORMAL}] sharepool: Extract sp_mapping_find sharepool: Support alloc ro mapping Guo Mengqi (14): mm: sharepool: remove deprecated interfaces mm: sharepool: proc_sp_group_state bugfix mm: sharepool: fix dvpp spm redundant print error mm: sharepool: fix statistics error mm: sharepool: fix static code-check errors mm: sharepool: delete redundant codes mm: sharepool: fix softlockup in high pressure use case. mm: sharepool: fix deadlock in spa_stat_of_mapping_show mm: sharepool: fix deadlock in sp_check_mmap_addr mm: sharepool: delete unused codes mm: sharepool: fix potential AA deadlock mm: sharepool: check size=0 in mg_sp_make_share_k2u() mm: sharepool: fix hugepage_rsvd count increase error Fix sharepool hugepage cgroup uncount error. Wang Wensheng (3): mm/sharepool: Delete unused sysctl interface mm/sharepool: Fix UAF reported by KASAN mm/sharepool: Rebind the numa node when fallback to normal pages Zhang Zekun (11): mm: sharepool: Remove unused sp_dev_va_start and sp_dev_va_size mm: sharepool: Remove sp_device_number_detect function mm: sharepool: Remove enable_mdc_default_group and change the definition of is_process_in_group() mm: sharepool: Remove the comment and fix a bug in mg_sp_group_id_by_pid() mm: sharepool: Add a read lock in proc_usage_show() mm: share_pool: Fix CodeCheck2.0 static warning Fix CodeCheck2.0 static check warning Fix the broken logic in mg_sp_group_add_task() Renaming __insert_sp_area to insert_sp_area Renaming __find_sp_area_locked to find_sp_area_locked Use space instead of tap before '*normal' and '*dvpp' Zhou Guanghui (6): mm/share pool: delete unnecessary judgment mm/share pool: Avoid UAF on spa mm/share pool: Check the maximum value of spg_id mm/share pool: Avoid UAF on mm mm/sharepool: bugfix for 2M U2K mm/share pool: fix the incorrect judgement of the addr range fs/hugetlbfs/inode.c | 19 +- include/linux/hugetlb.h | 6 +- include/linux/share_pool.h | 168 ++----- kernel/sysctl.c | 67 --- mm/hugetlb.c | 3 + mm/share_pool.c | 882 +++++++++++++------------------------ 6 files changed, 363 insertions(+), 782 deletions(-) -- 2.17.1

1 39

[PATCH openEuler-1.0-LTS 1/2] sch_sfb: Don't assume the skb is still around after enqueueing to child
by Yongqiang Liu 27 Oct '22

27 Oct '22

From: Toke Høiland-Jørgensen <toke(a)toke.dk> stable inclusion from stable-v4.19.258 commit 9245ed20950afe225bc6d1c4b9d28d55aa152e25 category: bugfix bugzilla: 187862, https://gitee.com/src-openeuler/kernel/issues/I5WF14 CVE: CVE-2022-3586 -------------------------------- [ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ] The sch_sfb enqueue() routine assumes the skb is still alive after it has been enqueued into a child qdisc, using the data in the skb cb field in the increment_qlen() routine after enqueue. However, the skb may in fact have been freed, causing a use-after-free in this case. In particular, this happens if sch_cake is used as a child of sfb, and the GSO splitting mode of CAKE is enabled (in which case the skb will be split into segments and the original skb freed). Fix this by copying the sfb cb data to the stack before enqueueing the skb, and using this stack copy in increment_qlen() instead of the skb pointer itself. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-18231 Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: chenweilong <chenweilong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/sched/sch_sfb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index 1aa95e761671..5e237f978075 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -139,15 +139,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot, struct sfb_sched_data *q) } } -static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_data *q) +static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_data *q) { u32 sfbhash; - sfbhash = sfb_hash(skb, 0); + sfbhash = cb->hashes[0]; if (sfbhash) increment_one_qlen(sfbhash, 0, q); - sfbhash = sfb_hash(skb, 1); + sfbhash = cb->hashes[1]; if (sfbhash) increment_one_qlen(sfbhash, 1, q); } @@ -287,6 +287,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sfb_sched_data *q = qdisc_priv(sch); struct Qdisc *child = q->qdisc; struct tcf_proto *fl; + struct sfb_skb_cb cb; int i; u32 p_min = ~0; u32 minqlen = ~0; @@ -403,11 +404,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch, } enqueue: + memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret = qdisc_enqueue(skb, child, to_free); if (likely(ret == NET_XMIT_SUCCESS)) { qdisc_qstats_backlog_inc(sch, skb); sch->q.qlen++; - increment_qlen(skb, q); + increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { q->stats.childdrop++; qdisc_qstats_drop(sch); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/4] inet: factor out inet_send_prepare()
by Yongqiang Liu 27 Oct '22

27 Oct '22

From: Paolo Abeni <pabeni(a)redhat.com> mainline inclusion from mainline-v5.3-rc1 commit e473093639945cb0a07ad4d51d5fd3fc3c3708cf category: bugfix bugzilla: 187846, https://gitee.com/src-openeuler/kernel/issues/I5W7YP CVE: CVE-2022-3567 --------------------------- The same code is replicated verbatim in multiple places, and the next patches will introduce an additional user for it. Factor out a helper and use it where appropriate. No functional change intended. Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/inet_common.h | 1 + net/ipv4/af_inet.c | 21 +++++++++++++-------- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/include/net/inet_common.h b/include/net/inet_common.h index 3ca969cbd161..4c2a6b175b34 100644 --- a/include/net/inet_common.h +++ b/include/net/inet_common.h @@ -23,6 +23,7 @@ int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags); int inet_accept(struct socket *sock, struct socket *newsock, int flags, bool kern); +int inet_send_prepare(struct sock *sk); int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size); ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags); diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index ba716480f2f1..d526dd68589d 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -784,10 +784,8 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr, } EXPORT_SYMBOL(inet_getname); -int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) +int inet_send_prepare(struct sock *sk) { - struct sock *sk = sock->sk; - sock_rps_record_flow(sk); /* We may need to bind the socket. */ @@ -795,6 +793,17 @@ int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) inet_autobind(sk)) return -EAGAIN; + return 0; +} +EXPORT_SYMBOL_GPL(inet_send_prepare); + +int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) +{ + struct sock *sk = sock->sk; + + if (unlikely(inet_send_prepare(sk))) + return -EAGAIN; + return sk->sk_prot->sendmsg(sk, msg, size); } EXPORT_SYMBOL(inet_sendmsg); @@ -804,11 +813,7 @@ ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, { struct sock *sk = sock->sk; - sock_rps_record_flow(sk); - - /* We may need to bind the socket. */ - if (!inet_sk(sk)->inet_num && !sk->sk_prot->no_autobind && - inet_autobind(sk)) + if (unlikely(inet_send_prepare(sk))) return -EAGAIN; if (sk->sk_prot->sendpage) -- 2.25.1

1 3

[PATCH openEuler-5.10 01/53] ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
by Zheng Zengkai 27 Oct '22

27 Oct '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187685, https://gitee.com/openeuler/kernel/issues/I5VVZX CVE: NA -------------------------------- Fix bad space budget when symlink file is encrypted. Bad space budget may let make_reservation() return with -ENOSPC, which could turn ubifs to read-only mode in do_writepage() process. Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216490 Fixes: ca7f85be8d6cf9 ("ubifs: Add support for encrypted symlinks") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/ubifs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index acd7e83a35e4..647a47ade5bd 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1148,7 +1148,6 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, int err, sz_change, len = strlen(symname); struct fscrypt_str disk_link; struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, - .new_ino_d = ALIGN(len, 8), .dirtied_ino = 1 }; struct fscrypt_name nm; @@ -1164,6 +1163,7 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, * Budget request settings: new inode, new direntry and changing parent * directory inode. */ + req.new_ino_d = ALIGN(disk_link.len - 1, 8); err = ubifs_budget_space(c, &req); if (err) return err; -- 2.20.1

1 52

[openEuler-5.10] roh/core: Add ROH device driver
by Zheng Zengkai 27 Oct '22

27 Oct '22

From: Ke Chen <chenke54(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5WKYW ----------------------------------------------------------------------- Add ROH device driver support, include: 1. roh core initialization 2. provide a registration framework for roh device. 3. etc. Signed-off-by: Ke Chen <chenke54(a)huawei.com> Reviewed-by: Gang Zhang <gang.zhang(a)huawei.com> Reviewed-by: Yefeng Yan <yanyefeng(a)huawei.com> Reviewed-by: Jingchao Dai <daijingchao1(a)huawei.com> --- drivers/Kconfig | 3 + drivers/Makefile | 1 + drivers/roh/Kconfig | 16 ++ drivers/roh/Makefile | 6 + drivers/roh/core/Makefile | 7 + drivers/roh/core/core.c | 481 +++++++++++++++++++++++++++++++++++ drivers/roh/core/core.h | 103 ++++++++ drivers/roh/core/core_priv.h | 21 ++ drivers/roh/core/main.c | 28 ++ 9 files changed, 666 insertions(+) create mode 100644 drivers/roh/Kconfig create mode 100644 drivers/roh/Makefile create mode 100644 drivers/roh/core/Makefile create mode 100644 drivers/roh/core/core.c create mode 100644 drivers/roh/core/core.h create mode 100644 drivers/roh/core/core_priv.h create mode 100644 drivers/roh/core/main.c diff --git a/drivers/Kconfig b/drivers/Kconfig index 9310808ee385..b1b3d958f065 100644 --- a/drivers/Kconfig +++ b/drivers/Kconfig @@ -237,4 +237,7 @@ source "drivers/interconnect/Kconfig" source "drivers/counter/Kconfig" source "drivers/most/Kconfig" + +source "drivers/roh/Kconfig" + endmenu diff --git a/drivers/Makefile b/drivers/Makefile index fd9c0b3da5f1..57e3773affcd 100644 --- a/drivers/Makefile +++ b/drivers/Makefile @@ -191,3 +191,4 @@ obj-$(CONFIG_GNSS) += gnss/ obj-$(CONFIG_INTERCONNECT) += interconnect/ obj-$(CONFIG_COUNTER) += counter/ obj-$(CONFIG_MOST) += most/ +obj-$(CONFIG_ROH) += roh/ diff --git a/drivers/roh/Kconfig b/drivers/roh/Kconfig new file mode 100644 index 000000000000..0ff2de261827 --- /dev/null +++ b/drivers/roh/Kconfig @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: GPL-2.0+ + +menuconfig ROH + tristate "ROH support" + depends on HAS_IOMEM && HAS_DMA + depends on NET + depends on INET + depends on m + select IRQ_POLL + select DIMLIB + help + Core support for ROH. Make sure to also select + any protocols you wish to use as well as drivers + for your ROH hardware. + + To compile ROH core as module, choose M here. diff --git a/drivers/roh/Makefile b/drivers/roh/Makefile new file mode 100644 index 000000000000..e5ea16bd6b21 --- /dev/null +++ b/drivers/roh/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0+ +# +# Makefile for the Linux kernel ROH device drivers. +# + +obj-$(CONFIG_ROH) += core/ diff --git a/drivers/roh/core/Makefile b/drivers/roh/core/Makefile new file mode 100644 index 000000000000..1c5ab1fc08ea --- /dev/null +++ b/drivers/roh/core/Makefile @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: GPL-2.0+ +# +# Makefile for the Linux kernel ROH Core drivers. +# + +roh_core-objs := main.o core.o +obj-$(CONFIG_ROH) += roh_core.o diff --git a/drivers/roh/core/core.c b/drivers/roh/core/core.c new file mode 100644 index 000000000000..39c1404e0d97 --- /dev/null +++ b/drivers/roh/core/core.c @@ -0,0 +1,481 @@ +// SPDX-License-Identifier: GPL-2.0+ +// Copyright (c) 2022 Hisilicon Limited. + +#include <linux/pci.h> +#include <net/rtnetlink.h> + +#include "core.h" +#include "core_priv.h" + +static DEFINE_XARRAY_FLAGS(devices, XA_FLAGS_ALLOC); +static DECLARE_RWSEM(devices_rwsem); +#define DEVICE_REGISTERED XA_MARK_1 + +static u32 highest_client_id; +#define CLIENT_REGISTERED XA_MARK_1 +static DEFINE_XARRAY_FLAGS(clients, XA_FLAGS_ALLOC); +static DECLARE_RWSEM(clients_rwsem); + +static void roh_client_put(struct roh_client *client) +{ + if (refcount_dec_and_test(&client->uses)) + complete(&client->uses_zero); +} + +#define CLIENT_DATA_REGISTERED XA_MARK_1 + +static int add_client_context(struct roh_device *device, + struct roh_client *client); +static void remove_client_context(struct roh_device *device, + unsigned int client_id); +static void __roh_unregister_device(struct roh_device *device); + +static void roh_device_release(struct device *device) +{ + struct roh_device *dev = container_of(device, struct roh_device, dev); + + WARN_ON(refcount_read(&dev->refcount)); + + mutex_destroy(&dev->unregistration_lock); + xa_destroy(&dev->client_data); + kfree(dev); +} + +static int roh_device_uevent(struct device *device, struct kobj_uevent_env *env) +{ + struct roh_device *dev = container_of(device, struct roh_device, dev); + + if (add_uevent_var(env, "NAME=%s", dev->name)) { + pr_err("failed to do add_uevent_var.\n"); + return -ENOMEM; + } + + return 0; +} + +static struct class roh_class = { + .name = "roh", + .dev_release = roh_device_release, + .dev_uevent = roh_device_uevent, +}; + +struct roh_device *roh_alloc_device(size_t size) +{ + struct roh_device *device; + + if (WARN_ON(size < sizeof(struct roh_device))) + return NULL; + + device = kzalloc(size, GFP_KERNEL); + if (!device) + return NULL; + + device->dev.class = &roh_class; + + device_initialize(&device->dev); + dev_set_drvdata(&device->dev, device); + + mutex_init(&device->unregistration_lock); + + xa_init_flags(&device->client_data, XA_FLAGS_ALLOC); + init_rwsem(&device->client_data_rwsem); + init_completion(&device->unreg_completion); + + return device; +} +EXPORT_SYMBOL(roh_alloc_device); + +void roh_dealloc_device(struct roh_device *device) +{ + down_write(&devices_rwsem); + if (xa_load(&devices, device->index) == device) + xa_erase(&devices, device->index); + up_write(&devices_rwsem); + + WARN_ON(!xa_empty(&device->client_data)); + WARN_ON(refcount_read(&device->refcount)); + + put_device(&device->dev); +} +EXPORT_SYMBOL(roh_dealloc_device); + +static int alloc_name(struct roh_device *device) +{ + struct roh_device *dev; + unsigned long index; + struct ida inuse; + int rc; + int i; + + lockdep_assert_held_write(&devices_rwsem); + + ida_init(&inuse); + xa_for_each(&devices, index, dev) { + char buf[ROH_DEVICE_NAME_MAX]; + + if (sscanf(dev_name(&dev->dev), device->name, &i) != 1) + continue; + if (i < 0 || i >= INT_MAX) + continue; + rc = snprintf(buf, sizeof(buf), device->name, i); + if (rc >= sizeof(buf) || rc < 0) { + ida_destroy(&inuse); + pr_err("device name is too long.\n"); + return -EINVAL; + } + + if (strcmp(buf, dev_name(&dev->dev)) != 0) + continue; + + rc = ida_alloc_range(&inuse, i, i, GFP_KERNEL); + if (rc < 0) + goto out; + } + + rc = ida_alloc(&inuse, GFP_KERNEL); + if (rc < 0) + goto out; + + rc = dev_set_name(&device->dev, device->name, rc); + +out: + ida_destroy(&inuse); + return rc; +} + +static void roh_device_put(struct roh_device *device) +{ + if (refcount_dec_and_test(&device->refcount)) + complete(&device->unreg_completion); +} + +struct roh_device *__roh_device_get_by_name(const char *name) +{ + struct roh_device *device; + unsigned long index; + + xa_for_each(&devices, index, device) + if (!strcmp(name, dev_name(&device->dev))) + return device; + + return NULL; +} + +static int assign_name(struct roh_device *device) +{ + static u32 last_id; + int ret; + + down_write(&devices_rwsem); + if (strchr(device->name, '%')) + ret = alloc_name(device); + else + ret = dev_set_name(&device->dev, device->name); + + if (ret) + goto out; + + if (__roh_device_get_by_name(dev_name(&device->dev))) { + ret = -ENFILE; + goto out; + } + + strlcpy(device->name, dev_name(&device->dev), ROH_DEVICE_NAME_MAX); + ret = xa_alloc_cyclic(&devices, &device->index, device, xa_limit_31b, + &last_id, GFP_KERNEL); + if (ret > 0) + ret = 0; + +out: + up_write(&devices_rwsem); + return ret; +} + +static void disable_device(struct roh_device *device) +{ + u32 cid; + + WARN_ON(!refcount_read(&device->refcount)); + + down_write(&devices_rwsem); + xa_clear_mark(&devices, device->index, DEVICE_REGISTERED); + up_write(&devices_rwsem); + + down_read(&clients_rwsem); + cid = highest_client_id; + up_read(&clients_rwsem); + while (cid) { + cid--; + remove_client_context(device, cid); + } + + roh_device_put(device); + wait_for_completion(&device->unreg_completion); +} + +static int enable_device_and_get(struct roh_device *device) +{ + struct roh_client *client; + unsigned long index; + int ret = 0; + + refcount_set(&device->refcount, MAX_DEVICE_REFCOUNT); + down_write(&devices_rwsem); + xa_set_mark(&devices, device->index, DEVICE_REGISTERED); + + downgrade_write(&devices_rwsem); + down_read(&clients_rwsem); + xa_for_each_marked(&clients, index, client, CLIENT_REGISTERED) { + ret = add_client_context(device, client); + if (ret) + break; + } + up_read(&clients_rwsem); + + up_read(&devices_rwsem); + + return ret; +} + +int roh_register_device(struct roh_device *device) +{ + int ret; + + ret = assign_name(device); + if (ret) { + pr_err("roh_core: failed to assigne name, ret = %d\n", ret); + return ret; + } + + dev_set_uevent_suppress(&device->dev, true); + ret = device_add(&device->dev); + if (ret) { + pr_err("roh_core: failed to add device, ret = %d\n", ret); + goto out; + } + + ret = enable_device_and_get(device); + dev_set_uevent_suppress(&device->dev, false); + kobject_uevent(&device->dev.kobj, KOBJ_ADD); + if (ret) { + roh_device_put(device); + __roh_unregister_device(device); + return ret; + } + + roh_device_put(device); + + return 0; +out: + dev_set_uevent_suppress(&device->dev, false); + return ret; +} +EXPORT_SYMBOL(roh_register_device); + +static void __roh_unregister_device(struct roh_device *device) +{ + mutex_lock(&device->unregistration_lock); + if (!refcount_read(&device->refcount)) + goto out; + + disable_device(device); + device_del(&device->dev); + +out: + mutex_unlock(&device->unregistration_lock); +} + +void roh_unregister_device(struct roh_device *device) +{ + get_device(&device->dev); + + __roh_unregister_device(device); + put_device(&device->dev); +} +EXPORT_SYMBOL(roh_unregister_device); + +void roh_set_client_data(struct roh_device *device, struct roh_client *client, + void *data) +{ + void *rc; + + if (WARN_ON(IS_ERR(data))) + data = NULL; + + rc = xa_store(&device->client_data, client->client_id, data, + GFP_KERNEL); + WARN_ON(xa_is_err(rc)); +} + +static void remove_client_context(struct roh_device *device, + unsigned int client_id) +{ + struct roh_client *client; + void *client_data; + + down_write(&device->client_data_rwsem); + if (!xa_get_mark(&device->client_data, client_id, + CLIENT_DATA_REGISTERED)) { + up_write(&device->client_data_rwsem); + return; + } + client_data = xa_load(&device->client_data, client_id); + xa_clear_mark(&device->client_data, client_id, CLIENT_DATA_REGISTERED); + client = xa_load(&clients, client_id); + up_write(&device->client_data_rwsem); + + if (client->remove) + client->remove(device, client_data); + + xa_erase(&device->client_data, client_id); + roh_device_put(device); + roh_client_put(client); +} + +static int add_client_context(struct roh_device *device, + struct roh_client *client) +{ + int ret = 0; + + down_write(&device->client_data_rwsem); + if (!refcount_inc_not_zero(&client->uses)) + goto out_unlock; + refcount_inc(&device->refcount); + + if (xa_get_mark(&device->client_data, client->client_id, + CLIENT_DATA_REGISTERED)) + goto out; + + ret = xa_err(xa_store(&device->client_data, client->client_id, NULL, + GFP_KERNEL)); + if (ret) + goto out; + + downgrade_write(&device->client_data_rwsem); + if (client->add) { + if (client->add(device)) { + xa_erase(&device->client_data, client->client_id); + up_read(&device->client_data_rwsem); + roh_device_put(device); + roh_client_put(client); + return 0; + } + } + + xa_set_mark(&device->client_data, client->client_id, + CLIENT_DATA_REGISTERED); + up_read(&device->client_data_rwsem); + + return 0; + +out: + roh_device_put(device); + roh_client_put(client); +out_unlock: + up_write(&device->client_data_rwsem); + return ret; +} + +static int assign_client_id(struct roh_client *client) +{ + int ret; + + down_write(&clients_rwsem); + + client->client_id = highest_client_id; + ret = xa_insert(&clients, client->client_id, client, GFP_KERNEL); + if (ret) + goto out; + + highest_client_id++; + xa_set_mark(&clients, client->client_id, CLIENT_REGISTERED); + +out: + up_write(&clients_rwsem); + return ret; +} + +static void remove_client_id(struct roh_client *client) +{ + down_write(&clients_rwsem); + xa_erase(&clients, client->client_id); + for (; highest_client_id; highest_client_id--) + if (xa_load(&clients, highest_client_id - 1)) + break; + up_write(&clients_rwsem); +} + +int roh_register_client(struct roh_client *client) +{ + struct roh_device *device; + unsigned long index; + int ret; + + refcount_set(&client->uses, 1); + init_completion(&client->uses_zero); + ret = assign_client_id(client); + if (ret) + return ret; + + down_read(&devices_rwsem); + xa_for_each_marked(&devices, index, device, DEVICE_REGISTERED) { + ret = add_client_context(device, client); + if (ret) { + up_read(&devices_rwsem); + roh_unregister_client(client); + return ret; + } + } + up_read(&devices_rwsem); + + return 0; +} + +void roh_unregister_client(struct roh_client *client) +{ + struct roh_device *device; + unsigned long index; + + down_write(&clients_rwsem); + roh_client_put(client); + xa_clear_mark(&clients, client->client_id, CLIENT_REGISTERED); + up_write(&clients_rwsem); + + rcu_read_lock(); + xa_for_each(&devices, index, device) { + if (!roh_device_try_get(device)) + continue; + rcu_read_unlock(); + + remove_client_context(device, client->client_id); + + roh_device_put(device); + rcu_read_lock(); + } + rcu_read_unlock(); + + wait_for_completion(&client->uses_zero); + remove_client_id(client); +} + +int roh_core_init(void) +{ + int ret; + + ret = class_register(&roh_class); + if (ret) { + pr_err("roh_core: couldn't create roh device class.\n"); + return ret; + } + + return 0; +} + +void roh_core_cleanup(void) +{ + class_unregister(&roh_class); +} + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Huawei Tech. Co., Ltd."); +MODULE_DESCRIPTION("ROH Core Driver"); diff --git a/drivers/roh/core/core.h b/drivers/roh/core/core.h new file mode 100644 index 000000000000..85f676a7a075 --- /dev/null +++ b/drivers/roh/core/core.h @@ -0,0 +1,103 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +// Copyright (c) 2022 Hisilicon Limited. + +#ifndef __CORE_H__ +#define __CORE_H__ + +#include <linux/types.h> +#include <linux/workqueue.h> +#include <linux/netdevice.h> +#include <net/bonding.h> + +#define ROH_DEVICE_NAME_MAX 64 +#define MAX_DEVICE_REFCOUNT 2 + +enum roh_dev_tx { + ROHDEV_TX_MIN = INT_MIN, /* make sure enum is signed */ + ROHDEV_TX_OK = 0x00, /* driver took care of packet */ + ROHDEV_TX_BUSY = 0x10, /* driver tx path was busy */ + ROHDEV_TX_LOCKED = 0x20 /* driver tx lock was already taken */ +}; + +enum roh_mib_type { ROH_MIB_PUBLIC = 0, ROH_MIB_PRIVATE }; + +static inline void convert_eid_to_mac(u8 mac[6], u32 eid) +{ + mac[0] = 0; + mac[1] = 0; + mac[2] = 0; + mac[3] = (eid >> 16) & 0xff; + mac[4] = (eid >> 8) & 0xff; + mac[5] = eid & 0xff; +} + +struct roh_eid_attr { + u32 base; + u32 num; +}; + +struct roh_guid_attr { + u8 data[16]; +}; + +struct roh_mib_stats { + struct mutex lock; /* Protect values[] */ + const char * const *names; + u32 num_counters; + u64 value[]; +}; + +struct roh_device; +struct roh_device_ops { + int (*query_guid)(struct roh_device *device, struct roh_guid_attr *attr); + int (*set_eid)(struct roh_device *device, struct roh_eid_attr *attr); + struct sk_buff *(*pkt_create)(struct net_device *ndev, + u8 *dest_mac, u8 *src_mac, int ptype, + struct roh_guid_attr *guid, u16 eid_nums); + int (*pkt_parse)(struct sk_buff *skb, struct roh_eid_attr *eid_attr, int ptype); + enum roh_dev_tx (*xmit_pkt)(struct roh_device *device, struct sk_buff *skb); + struct roh_mib_stats *(*alloc_hw_stats)(struct roh_device *device, enum roh_mib_type); + int (*get_hw_stats)(struct roh_device *device, + struct roh_mib_stats *stats, enum roh_mib_type); +}; + +struct roh_device { + struct device dev; + char name[ROH_DEVICE_NAME_MAX]; + struct roh_device_ops ops; + u32 abi_ver; + + struct rcu_head rcu_head; + struct rw_semaphore client_data_rwsem; + struct xarray client_data; + + struct module *owner; + struct net_device *netdev; + + u32 index; + /* + * Positive refcount indicates that the device is currently + * registered and cannot be unregistered. + */ + refcount_t refcount; + struct completion unreg_completion; + struct mutex unregistration_lock; /* lock for unregiste */ +}; + +static inline bool roh_device_try_get(struct roh_device *device) +{ + return refcount_inc_not_zero(&device->refcount); +} + +struct roh_device *__roh_device_get_by_name(const char *name); + +struct roh_device *roh_alloc_device(size_t size); +void roh_dealloc_device(struct roh_device *device); + +int roh_register_device(struct roh_device *device); +void roh_unregister_device(struct roh_device *device); + +int roh_core_init(void); +void roh_core_cleanup(void); + +#endif /* __CORE_H__ */ diff --git a/drivers/roh/core/core_priv.h b/drivers/roh/core/core_priv.h new file mode 100644 index 000000000000..7e21cc807044 --- /dev/null +++ b/drivers/roh/core/core_priv.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +// Copyright (c) 2022 Hisilicon Limited. + +#ifndef __CORE_PRIV_H__ +#define __CORE_PRIV_H__ + +struct roh_client { + char *name; + int (*add)(struct roh_device *device); + void (*remove)(struct roh_device *device, void *client_data); + refcount_t uses; + u32 client_id; + struct completion uses_zero; +}; + +int roh_register_client(struct roh_client *client); +void roh_unregister_client(struct roh_client *client); +void roh_set_client_data(struct roh_device *device, + struct roh_client *client, void *data); + +#endif /* __CORE_PRIV_H__ */ diff --git a/drivers/roh/core/main.c b/drivers/roh/core/main.c new file mode 100644 index 000000000000..0f766f85eaf5 --- /dev/null +++ b/drivers/roh/core/main.c @@ -0,0 +1,28 @@ +// SPDX-License-Identifier: GPL-2.0+ +// Copyright (c) 2022 Hisilicon Limited. + +#include <linux/init.h> +#include <linux/module.h> + +#include "core.h" + +static int __init roh_init(void) +{ + int ret; + + ret = roh_core_init(); + if (ret) { + pr_err("roh_core: roh core init failed.\n"); + return ret; + } + + return 0; +} + +static void __exit roh_cleanup(void) +{ + roh_core_cleanup(); +} + +module_init(roh_init); +module_exit(roh_cleanup); -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] nilfs2: fix use-after-free bug of struct nilfs_root
by Yongqiang Liu 27 Oct '22

27 Oct '22

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.1-rc1 commit d325dc6eb763c10f591c239550b8c7e5466a5d09 category: bugfix bugzilla: 187877,https://gitee.com/src-openeuler/kernel/issues/I5X3MX CVE: CVE-2022-3649 -------------------------------- If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses. This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap. Link: https://lkml.kernel.org/r/20221003150519.39789-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b8c672b0e22615c80fe0(a)syzkaller.appspotmail.com Reported-by: Khalid Masum <khalid.masum.92(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflict: fs/nilfs2/inode.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/nilfs2/inode.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 671085512e0f..ca380c6d7825 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -335,6 +335,7 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode) struct inode *inode; struct nilfs_inode_info *ii; struct nilfs_root *root; + struct buffer_head *bh; int err = -ENOMEM; ino_t ino; @@ -350,11 +351,26 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode) ii->i_state = BIT(NILFS_I_NEW); ii->i_root = root; - err = nilfs_ifile_create_inode(root->ifile, &ino, &ii->i_bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); if (unlikely(err)) goto failed_ifile_create_inode; /* reference count of i_bh inherits from nilfs_mdt_read_block() */ + if (unlikely(ino < NILFS_USER_INO)) { + nilfs_msg(sb, KERN_WARNING, + "inode bitmap is inconsistent for reserved inodes"); + do { + brelse(bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); + if (unlikely(err)) + goto failed_ifile_create_inode; + } while (ino < NILFS_USER_INO); + + nilfs_msg(sb, KERN_INFO, + "repaired inode bitmap for reserved inodes"); + } + ii->i_bh = bh; + atomic64_inc(&root->inodes_count); inode_init_owner(inode, dir, mode); inode->i_ino = ino; -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS] nilfs2: fix use-after-free bug of struct nilfs_root
by Zheng Zengkai 27 Oct '22

27 Oct '22

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.148 commit 21ee3cffed8fbabb669435facfd576ba18ac8652 category: bugfix bugzilla:187877,https://gitee.com/src-openeuler/kernel/issues/I5X3MX CVE: CVE-2022-3649 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d325dc6eb763c10f591c239550b8c7e5466a5d09 upstream. If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses. This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap. Link: https://lkml.kernel.org/r/20221003150519.39789-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b8c672b0e22615c80fe0(a)syzkaller.appspotmail.com Reported-by: Khalid Masum <khalid.masum.92(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/nilfs2/inode.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 95684fa3c985..3e4874b0c55c 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -332,6 +332,7 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode) struct inode *inode; struct nilfs_inode_info *ii; struct nilfs_root *root; + struct buffer_head *bh; int err = -ENOMEM; ino_t ino; @@ -347,11 +348,25 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode) ii->i_state = BIT(NILFS_I_NEW); ii->i_root = root; - err = nilfs_ifile_create_inode(root->ifile, &ino, &ii->i_bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); if (unlikely(err)) goto failed_ifile_create_inode; /* reference count of i_bh inherits from nilfs_mdt_read_block() */ + if (unlikely(ino < NILFS_USER_INO)) { + nilfs_warn(sb, + "inode bitmap is inconsistent for reserved inodes"); + do { + brelse(bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); + if (unlikely(err)) + goto failed_ifile_create_inode; + } while (ino < NILFS_USER_INO); + + nilfs_info(sb, "repaired inode bitmap for reserved inodes"); + } + ii->i_bh = bh; + atomic64_inc(&root->inodes_count); inode_init_owner(inode, dir, mode); inode->i_ino = ino; -- 2.20.1

1 0

[PATCH openEuler-5.10-LTS 01/31] ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
by Zheng Zengkai 26 Oct '22

26 Oct '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187685, https://gitee.com/openeuler/kernel/issues/I5VVZX CVE: NA -------------------------------- Fix bad space budget when symlink file is encrypted. Bad space budget may let make_reservation() return with -ENOSPC, which could turn ubifs to read-only mode in do_writepage() process. Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216490 Fixes: ca7f85be8d6cf9 ("ubifs: Add support for encrypted symlinks") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/ubifs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index f5777f59a101..b73904c1fbf7 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1145,7 +1145,6 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, int err, sz_change, len = strlen(symname); struct fscrypt_str disk_link; struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, - .new_ino_d = ALIGN(len, 8), .dirtied_ino = 1 }; struct fscrypt_name nm; @@ -1161,6 +1160,7 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, * Budget request settings: new inode, new direntry and changing parent * directory inode. */ + req.new_ino_d = ALIGN(disk_link.len - 1, 8); err = ubifs_budget_space(c, &req); if (err) return err; -- 2.20.1

1 30

[openEuler-5.10-LTS 00/99] Backport 5.10.127 LTS
by Zheng Zengkai 26 Oct '22

26 Oct '22

Backport 5.10.127 LTS patches from upstream. git cherry-pick v5.10.126..v5.10.127~1 -s Already merged(-1): 3acb7dc242ca vt: drop old FONT ioctls kabi changed and its related patch(-2): 3ee62a1f0701a nvme: split nvme_alloc_request() ba388d4e9a68 nvme: don't check nvme_req flags for new req Total patches: 102 - 1 - 2 = 99 Aidan MacDonald (1): regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips Alan Stern (2): usb: gadget: Fix non-unique driver names in raw-gadget driver USB: gadget: Fix double-free bug in raw_gadget driver Alexander Stein (1): ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node Anatolii Gerasymenko (1): ice: ethtool: advertise 1000M speeds properly Andrew Donnellan (1): powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address Andy Shevchenko (1): usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC Baruch Siach (1): iio: adc: vf610: fix conversion mode sysfs node name Carlo Lobrano (1): USB: serial: option: add Telit LE910Cx 0x1250 composition Chaitanya Kulkarni (2): nvme: centralize setting the timeout in nvme_alloc_request nvme: mark nvme_setup_passsthru() inline Chevron Li (1): mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing Christoph Hellwig (1): nvme: move the Samsung X5 quirk entry to the core quirks Claudiu Manoil (1): phy: aquantia: Fix AN when higher speeds than 1G are not advertised Damien Le Moal (1): scsi: scsi_debug: Fix zone transition to full condition Dan Carpenter (1): gpio: winbond: Fix error code in winbond_gpio_get() David Howells (1): afs: Fix dynamic root getattr David Sterba (1): btrfs: add error messages to all unrecognized mount options Dmitry Rokosov (3): iio:chemical:ccs811: rearrange iio trigger get and register iio:accel:bma180: rearrange iio trigger get and register iio:accel:mxc4005: rearrange iio trigger get and register Edward Wu (1): ata: libata: add qc->flags in ata_qc_complete_template tracepoint Enzo Matsumiya (1): nvme-pci: add NO APST quirk for Kioxia device Eric Dumazet (1): erspan: do not assume transport header is always set Florian Westphal (1): netfilter: use get_random_u32 instead of prandom Gerd Hoffmann (1): udmabuf: add back sanity check Haibo Chen (2): iio: mma8452: fix probe fail when device tree compatible is used. iio: accel: mma8452: ignore the return value of reset operation Hans de Goede (1): iio: adc: axp288: Override TS pin bias current for some models Helge Deller (2): parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI parisc: Enable ARCH_HAS_STRICT_MODULE_RWX Hoang Le (1): tipc: fix use-after-free Read in tipc_named_reinit Jaegeuk Kim (1): f2fs: attach inline_data after setting compression Jakub Kicinski (1): Revert "net/tls: fix tls_sk_proto_close executed repeatedly" Jakub Sitnicki (1): bpf, x86: Fix tail call count offset calculation on bpf2bpf call Jason A. Donenfeld (5): random: schedule mix_interrupt_randomness() less often random: quiet urandom warning ratelimit suppression message powerpc/powernv: wire up rng during setup_arch random: update comment from copy_to_user() -> copy_to_iter() powerpc/pseries: wire up rng during setup_arch() Jay Vosburgh (1): bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers Jean-Baptiste Maneyrol (1): iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value) Jie2x Zhou (1): selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh Jon Maxwell (1): bpf: Fix request_sock leak in sk lookup helpers Jonathan Marek (1): drm/msm: use for_each_sgtable_sg to iterate over scatterlist Julien Grall (1): x86/xen: Remove undefined behavior in setup_features() Kai-Heng Feng (1): igb: Make DMA faster when CPU is active on the PCIe link Kailang Yang (1): ALSA: hda/realtek - ALC897 headset MIC no sound Keith Busch (1): nvme-pci: allocate nvme_command within driver pdu Kuogee Hsieh (5): drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind() drm/msm/dp: fixes wrong connection state caused by failure of link train drm/msm/dp: deinitialize mainlink if link training failed drm/msm/dp: promote irq_hpd handle to handle link training correctly drm/msm/dp: fix connect/disconnect handled at irq_hpd Liang He (2): xtensa: xtfpga: Fix refcount leak bug in setup xtensa: Fix refcount leak bug in time.c Lorenzo Bianconi (1): igb: fix a use-after-free issue in igb_clean_tx_ring Lucas Stach (1): ARM: dts: imx6qdl: correct PU regulator ramp delay Macpaul Lin (1): USB: serial: option: add Quectel RM500K module support Masahiro Yamada (2): modpost: fix section mismatch check for exported init/exit sections kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt) Mathias Nyman (1): xhci: turn off port power in shutdown Maximilian Luz (1): drm/msm: Fix double pm_runtime_disable() call Miaoqian Lin (7): drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client ARM: exynos: Fix refcount leak in exynos_map_pmu soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe ARM: Fix refcount leak in axxia_boot_secondary memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings ARM: cns3xxx: Fix refcount leak in cns3xxx_init Mikulas Patocka (1): dm mirror log: clear log bits up to BITS_PER_LONG boundary Naveen N. Rao (1): powerpc: Enable execve syscall exit tracepoint Nikos Tsironis (1): dm era: commit metadata in postsuspend after worker stops Olivier Moysan (1): iio: adc: stm32: fix maximum clock rate for stm32mp15x Pablo Neira Ayuso (2): netfilter: nftables: add nft_parse_register_load() and use it netfilter: nftables: add nft_parse_register_store() and use it Peilin Ye (1): net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms Rosemarie O'Riorden (1): net: openvswitch: fix parsing of nw_proto for IPv6 fragments Samuel Holland (1): drm/sun4i: Fix crash during suspend after component bind failure Sascha Hauer (1): mtd: rawnand: gpmi: Fix setting busy timeout setting Soham Sen (1): ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop Stephan Gerhold (1): virtio_net: fix xdp_rxq_info bug after suspend/resume Takashi Iwai (3): ALSA: hda/via: Fix missing beep setup ALSA: hda/conexant: Fix missing beep setup ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly Tanveer Alam (1): xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI Thomas Richter (1): s390/cpumf: Handle events cycles and instructions identical Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo PD70PNT ALSA: hda/realtek: Add quirk for Clevo NS50PU Utkarsh Patel (1): xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI Vincent Whitchurch (1): iio: trigger: sysfs: fix use-after-free on remove Xin Long (1): tipc: simplify the finalize work queue Xu Yang (1): usb: chipidea: udc: check request status before setting device address Yannick Brosseau (2): iio: adc: stm32: Fix ADCs iteration in irq handler iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message Yonglin Tan (1): USB: serial: option: add Quectel EM05-G modem Zheyu Ma (1): iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() Ziyang Xuan (1): net/tls: fix tls_sk_proto_close executed repeatedly huhai (1): MIPS: Remove repetitive increase irq_err_count Documentation/ABI/testing/sysfs-bus-iio-vf610 | 2 +- Makefile | 2 +- arch/arm/boot/dts/imx6qdl.dtsi | 2 +- arch/arm/boot/dts/imx7s.dtsi | 2 +- arch/arm/mach-axxia/platsmp.c | 1 + arch/arm/mach-cns3xxx/core.c | 2 + arch/arm/mach-exynos/exynos.c | 1 + arch/mips/vr41xx/common/icu.c | 2 - arch/parisc/Kconfig | 1 + arch/parisc/include/asm/fb.h | 2 +- arch/powerpc/kernel/process.c | 2 +- arch/powerpc/kernel/rtas.c | 11 +- arch/powerpc/platforms/powernv/powernv.h | 2 + arch/powerpc/platforms/powernv/rng.c | 52 ++++-- arch/powerpc/platforms/powernv/setup.c | 2 + arch/powerpc/platforms/pseries/pseries.h | 2 + arch/powerpc/platforms/pseries/rng.c | 11 +- arch/powerpc/platforms/pseries/setup.c | 2 + arch/s390/kernel/perf_cpum_cf.c | 22 ++- arch/x86/net/bpf_jit_comp.c | 3 +- arch/xtensa/kernel/time.c | 1 + arch/xtensa/platforms/xtfpga/setup.c | 1 + drivers/base/regmap/regmap-irq.c | 5 +- drivers/char/random.c | 6 +- drivers/dma-buf/udmabuf.c | 5 +- drivers/gpio/gpio-vr41xx.c | 2 - drivers/gpio/gpio-winbond.c | 7 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 3 +- drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 2 + drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +- drivers/gpu/drm/msm/dp/dp_catalog.h | 2 +- drivers/gpu/drm/msm/dp/dp_ctrl.c | 40 ++++- drivers/gpu/drm/msm/dp/dp_display.c | 149 ++++++++++++------ drivers/gpu/drm/msm/dp/dp_panel.c | 5 + drivers/gpu/drm/msm/msm_iommu.c | 2 +- drivers/gpu/drm/sun4i/sun4i_drv.c | 4 +- drivers/iio/accel/bma180.c | 3 +- drivers/iio/accel/mma8452.c | 22 ++- drivers/iio/accel/mxc4005.c | 4 +- drivers/iio/adc/adi-axi-adc.c | 3 + drivers/iio/adc/axp288_adc.c | 8 + drivers/iio/adc/stm32-adc-core.c | 9 +- drivers/iio/adc/stm32-adc.c | 10 -- drivers/iio/chemical/ccs811.c | 4 +- drivers/iio/gyro/mpu3050-core.c | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + .../iio/imu/inv_icm42600/inv_icm42600_core.c | 2 +- drivers/iio/trigger/iio-trig-sysfs.c | 1 + drivers/md/dm-era-target.c | 8 +- drivers/md/dm-log.c | 2 +- drivers/memory/samsung/exynos5422-dmc.c | 29 ++-- drivers/mmc/host/sdhci-pci-o2micro.c | 2 + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- drivers/net/bonding/bond_main.c | 4 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 39 ++++- drivers/net/ethernet/intel/igb/igb_main.c | 19 +-- drivers/net/phy/aquantia_main.c | 15 +- drivers/net/virtio_net.c | 25 +-- drivers/nvme/host/core.c | 41 ++++- drivers/nvme/host/lightnvm.c | 3 +- drivers/nvme/host/pci.c | 17 +- drivers/scsi/scsi_debug.c | 22 ++- drivers/soc/bcm/brcmstb/pm/pm-arm.c | 1 + drivers/usb/chipidea/udc.c | 3 + drivers/usb/gadget/legacy/raw_gadget.c | 63 ++++++-- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-pci.c | 6 +- drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 2 + drivers/usb/serial/option.c | 6 + drivers/usb/typec/tcpm/Kconfig | 1 - drivers/video/console/sticore.c | 2 + drivers/xen/features.c | 2 +- fs/afs/inode.c | 3 +- fs/btrfs/super.c | 39 ++++- fs/f2fs/namei.c | 17 +- include/linux/ratelimit_types.h | 12 +- include/net/netfilter/nf_tables.h | 10 +- include/net/netfilter/nf_tables_core.h | 12 +- include/net/netfilter/nft_fib.h | 2 +- include/net/netfilter/nft_meta.h | 4 +- include/trace/events/libata.h | 1 + net/bridge/netfilter/nft_meta_bridge.c | 5 +- net/core/filter.c | 34 +++- net/ipv4/ip_gre.c | 15 +- net/ipv4/netfilter/nft_dup_ipv4.c | 18 +-- net/ipv6/ip6_gre.c | 15 +- net/ipv6/netfilter/nft_dup_ipv6.c | 18 +-- net/netfilter/nf_tables_api.c | 52 +++++- net/netfilter/nft_bitwise.c | 23 ++- net/netfilter/nft_byteorder.c | 14 +- net/netfilter/nft_cmp.c | 8 +- net/netfilter/nft_ct.c | 12 +- net/netfilter/nft_dup_netdev.c | 6 +- net/netfilter/nft_dynset.c | 12 +- net/netfilter/nft_exthdr.c | 14 +- net/netfilter/nft_fib.c | 5 +- net/netfilter/nft_fwd_netdev.c | 18 +-- net/netfilter/nft_hash.c | 25 ++- net/netfilter/nft_immediate.c | 6 +- net/netfilter/nft_lookup.c | 14 +- net/netfilter/nft_masq.c | 18 +-- net/netfilter/nft_meta.c | 21 +-- net/netfilter/nft_nat.c | 35 ++-- net/netfilter/nft_numgen.c | 27 ++-- net/netfilter/nft_objref.c | 6 +- net/netfilter/nft_osf.c | 8 +- net/netfilter/nft_payload.c | 10 +- net/netfilter/nft_queue.c | 12 +- net/netfilter/nft_range.c | 6 +- net/netfilter/nft_redir.c | 18 +-- net/netfilter/nft_rt.c | 7 +- net/netfilter/nft_socket.c | 7 +- net/netfilter/nft_tproxy.c | 14 +- net/netfilter/nft_tunnel.c | 8 +- net/netfilter/nft_xfrm.c | 7 +- net/openvswitch/flow.c | 2 +- net/sched/sch_netem.c | 4 +- net/tipc/core.c | 7 +- net/tipc/core.h | 8 +- net/tipc/discover.c | 4 +- net/tipc/link.c | 5 + net/tipc/link.h | 1 + net/tipc/net.c | 15 +- scripts/mod/modpost.c | 2 +- sound/pci/hda/hda_auto_parser.c | 7 +- sound/pci/hda/hda_local.h | 1 + sound/pci/hda/patch_conexant.c | 4 +- sound/pci/hda/patch_realtek.c | 36 ++++- sound/pci/hda/patch_via.c | 4 +- .../selftests/netfilter/nft_concat_range.sh | 2 +- 131 files changed, 949 insertions(+), 532 deletions(-) -- 2.20.1

1 99

[openEuler-5.10-LTS 00/10] Backport 5.10.125 LTS
by Zheng Zengkai 26 Oct '22

26 Oct '22

Backport 5.10.125 LTS patches from upstream. git cherry-pick v5.10.124..v5.10.125~1 -s Already merged(-2): 9429b75bc271 tcp: increase source port perturb table to 2^16 df3f3bb5059d io_uring: add missing item types for various requests Context conflict: 24b922a5da00 tcp: dynamically allocate the perturb table used by source ports Total patches: 12 - 2 = 10 Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect() Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer Willy Tarreau (4): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: drop the hash_32() part from the index calculation arch/arm64/mm/cache.S | 2 - arch/s390/mm/pgtable.c | 2 +- drivers/tty/serial/serial_core.c | 34 ++++------ drivers/usb/gadget/function/u_ether.c | 11 +++- fs/zonefs/super.c | 92 ++++++++++++++++++--------- net/ipv4/inet_hashtables.c | 22 +++++-- 6 files changed, 102 insertions(+), 61 deletions(-) -- 2.20.1

1 10

[PATCH openEuler-5.10-LTS 00/80] Backport 5.10.124 LTS
by Zheng Zengkai 26 Oct '22

26 Oct '22

Backport 5.10.124 LTS patches from upstream. git cherry-pick v5.10.123..v5.10.124~1 -s Already merged(-3): 2c9548bc2650 powerpc/kasan: Silence KASAN warnings in __get_wchan() 6fdaf31ad5f3 ext4: fix bug_on ext4_mb_use_inode_pa 0ca74dacfd47 ext4: make variable "count" signed Context conflict: 4603a37f6eae random: credit cpu and bootloader seeds by default Total patches: 83 - 3 = 80 Adam Ford (2): arm64: dts: imx8mm-beacon: Enable RTS-CTS on UART3 ASoC: wm8962: Fix suspend while playing music Al Viro (1): 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" Alan Previn (1): drm/i915/reset: Fix error_state_read ptr + offset use Aleksandr Loktionov (1): i40e: Fix call trace in setup_tx_descriptors Alexander Usyskin (1): mei: me: add raptor lake point S DID Andy Chi (1): ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine Ashish Kalra (1): KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak Bart Van Assche (1): block: Fix handling of offline queues in blk_mq_alloc_request_hctx() Charles Keepax (6): ASoC: cs42l52: Fix TLV scales for mixer controls ASoC: cs35l36: Update digital volume TLV ASoC: cs53l30: Correct number of volume levels on SX controls ASoC: cs42l52: Correct TLV for Bypass Volume ASoC: cs42l56: Correct typo in minimum level for SX volume controls ASoC: cs42l51: Correct minimum value for SX volume control Chen Lin (1): net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag Chengguang Xu (2): scsi: ipr: Fix missing/incorrect resource cleanup in error case scsi: pmcraid: Fix missing resource cleanup in error case Christophe JAILLET (1): net: bgmac: Fix an erroneous kfree() in bgmac_remove() Daniel Wagner (1): nvme: use sysfs_emit instead of sprintf Davide Caratti (1): net/sched: act_police: more accurate MTU policing Duoming Zhou (1): net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg Grzegorz Szczurek (2): i40e: Fix adding ADQ filter to TC0 i40e: Fix calculating the number of queue pairs Hui Wang (1): ASoC: nau8822: Add operation for internal PLL off and on Ian Abbott (1): comedi: vmk80xx: fix expression for tx buffer size Ilpo Järvinen (1): serial: 8250: Store to lsr_save_flags after lsr read Ilya Maximets (1): net: openvswitch: fix misuse of the cached connection on tuple changes James Smart (2): scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion Jason A. Donenfeld (2): random: credit cpu and bootloader seeds by default crypto: memneq - move into lib/ Jiasheng Jiang (1): i2c: npcm7xx: Add check for platform_driver_register Josh Poimboeuf (1): faddr2line: Fix overlapping text section failures, the sequel Linus Torvalds (1): mellanox: mlx5: avoid uninitialized variable warning with gcc-12 Marc Zyngier (1): KVM: arm64: Don't read a HW interrupt pending state in user context Marius Hoch (1): Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq Mark Brown (2): ASoC: es8328: Fix event generation for deemphasis control ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() Mark Rutland (2): arm64: ftrace: fix branch range checks arm64: ftrace: consistently handle PLTs. Masahiro Yamada (3): clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() certs/blacklist_hashes.c: fix const confusion in certs blacklist powerpc/book3e: get rid of #include <generated/compile.h> Matthew Wilcox (Oracle) (1): quota: Prevent memory allocation recursion while holding dq_lock Miaoqian Lin (6): misc: atmel-ssc: Fix IRQ check in ssc_probe irqchip/gic/realview: Fix refcount leak in realview_gic_of_init irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions usb: dwc2: Fix memory leak in dwc2_hcd_init usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe Mikulas Patocka (1): dm mirror log: round up region bitmap size to BITS_PER_LONG Murilo Opsfelder Araujo (1): virtio-pci: Remove wrong address verification in vp_del_vqs() Peng Fan (1): clk: imx8mp: fix usb_root_clk parent Petr Machata (1): mlxsw: spectrum_cnt: Reorder counter pools Rob Clark (1): dma-debug: make things less spammy under memory pressure Robert Eckelmann (1): USB: serial: io_ti: add Agilent E5805A support Robin Murphy (1): dma-direct: don't over-decrypt memory Roman Li (1): drm/amd/display: Cap OLED brightness per max frame-average luminance Saurabh Sengar (1): Drivers: hv: vmbus: Release cpu lock in error case Sean Christopherson (1): KVM: x86: Account a variety of miscellaneous allocations Serge Semin (2): gpio: dwapb: Don't print error on -EPROBE_DEFER i2c: designware: Use standard optional ref clock implementation Sergey Shtylyov (1): ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() Slark Xiao (1): USB: serial: option: add support for Cinterion MV31 with new baseline Thomas Weißschuh (1): nvme: add device name to warning in uuid_show() Trond Myklebust (3): nfsd: Replace use of rwsem with errseq_t pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE pNFS: Avoid a live lock condition in pnfs_update_layout() Vincent Whitchurch (1): tty: goldfish: Fix free_irq() on remove Vinicius Costa Gomes (2): Revert "PCI: Make pci_enable_ptm() private" igc: Enable PCIe PTM Wang Yufen (1): ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg Wentao Wang (1): scsi: vmw_pvscsi: Expand vcpuHint to 16 bits Xiaohui Zhang (1): nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred Yuntao Wang (1): bpf: Fix incorrect memory charge cost calculation in stack_map_alloc() Yupeng Li (1): MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error. Zhang Yi (1): ext4: add reserved GDT blocks check chengkaitao (1): virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed huangwenhui (1): ALSA: hda/realtek - Add HW8326 support .../freescale/imx8mm-beacon-baseboard.dtsi | 3 + arch/arm64/kernel/ftrace.c | 137 +++++++++--------- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 4 +- arch/arm64/kvm/vgic/vgic-mmio.c | 19 ++- arch/arm64/kvm/vgic/vgic-mmio.h | 3 + arch/powerpc/mm/nohash/kaslr_booke.c | 8 +- arch/x86/kvm/svm/nested.c | 4 +- arch/x86/kvm/svm/sev.c | 4 +- arch/x86/kvm/vmx/vmx.c | 2 +- block/blk-mq.c | 2 + certs/blacklist_hashes.c | 2 +- crypto/Kconfig | 1 + crypto/Makefile | 2 +- drivers/ata/libata-core.c | 4 +- drivers/char/Kconfig | 54 ++++--- drivers/clk/imx/clk-imx8mp.c | 2 +- drivers/clocksource/hyperv_timer.c | 1 - drivers/gpio/gpio-dwapb.c | 7 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +- drivers/gpu/drm/i915/i915_sysfs.c | 15 +- drivers/hv/channel_mgmt.c | 1 + drivers/i2c/busses/i2c-designware-common.c | 3 - drivers/i2c/busses/i2c-designware-platdrv.c | 13 +- drivers/i2c/busses/i2c-npcm7xx.c | 3 +- drivers/input/misc/soc_button_array.c | 4 +- drivers/irqchip/irq-gic-realview.c | 1 + drivers/irqchip/irq-gic-v3.c | 7 +- drivers/md/dm-log.c | 3 +- drivers/misc/atmel-ssc.c | 4 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/net/ethernet/broadcom/bgmac-bcma.c | 1 - .../net/ethernet/intel/i40e/i40e_ethtool.c | 25 +++- drivers/net/ethernet/intel/i40e/i40e_main.c | 5 + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +- drivers/net/ethernet/intel/igc/igc_main.c | 5 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 21 ++- drivers/net/ethernet/mellanox/mlx5/core/lag.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_cnt.h | 2 +- drivers/nfc/nfcmrvl/usb.c | 16 +- drivers/nvme/host/core.c | 44 +++--- drivers/nvme/host/multipath.c | 8 +- drivers/pci/pci.h | 3 - drivers/platform/mips/Kconfig | 2 +- drivers/scsi/ipr.c | 4 +- drivers/scsi/lpfc/lpfc_hw4.h | 3 + drivers/scsi/lpfc/lpfc_nportdisc.c | 3 +- drivers/scsi/lpfc/lpfc_nvme.c | 11 +- drivers/scsi/pmcraid.c | 2 +- drivers/scsi/vmw_pvscsi.h | 4 +- drivers/staging/comedi/drivers/vmk80xx.c | 2 +- drivers/tty/goldfish.c | 2 +- drivers/tty/serial/8250/8250_port.c | 2 + drivers/usb/dwc2/hcd.c | 2 +- drivers/usb/gadget/udc/lpc32xx_udc.c | 1 + drivers/usb/serial/io_ti.c | 2 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 6 + drivers/virtio/virtio_mmio.c | 1 + drivers/virtio/virtio_pci_common.c | 3 +- fs/9p/vfs_inode_dotl.c | 10 +- fs/ext4/resize.c | 10 ++ fs/nfs/callback_proc.c | 1 + fs/nfs/pnfs.c | 21 ++- fs/nfs/pnfs.h | 1 + fs/nfsd/filecache.c | 1 - fs/nfsd/filecache.h | 1 - fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/vfs.c | 40 ++--- fs/quota/dquot.c | 10 ++ include/linux/pci.h | 7 + kernel/bpf/stackmap.c | 3 +- kernel/dma/debug.c | 2 +- kernel/dma/direct.c | 16 +- lib/Kconfig | 3 + lib/Makefile | 1 + lib/crypto/Kconfig | 1 + {crypto => lib}/memneq.c | 0 net/ax25/af_ax25.c | 34 ++++- net/l2tp/l2tp_ip6.c | 5 +- net/openvswitch/actions.c | 6 + net/openvswitch/conntrack.c | 3 +- net/sched/act_police.c | 16 +- scripts/faddr2line | 45 ++++-- sound/hda/hdac_device.c | 1 + sound/pci/hda/patch_realtek.c | 15 ++ sound/soc/codecs/cs35l36.c | 3 +- sound/soc/codecs/cs42l51.c | 2 +- sound/soc/codecs/cs42l52.c | 8 +- sound/soc/codecs/cs42l56.c | 4 +- sound/soc/codecs/cs53l30.c | 16 +- sound/soc/codecs/es8328.c | 5 +- sound/soc/codecs/nau8822.c | 4 + sound/soc/codecs/nau8822.h | 3 + sound/soc/codecs/wm8962.c | 1 + sound/soc/codecs/wm_adsp.c | 2 +- .../selftests/net/forwarding/tc_police.sh | 52 +++++++ 97 files changed, 578 insertions(+), 292 deletions(-) rename {crypto => lib}/memneq.c (100%) -- 2.20.1

1 80

[PATCH openEuler-5.10 0/4] Try to fix kabi change caused by Intel AMX
by Zheng Zengkai 26 Oct '22

26 Oct '22

These four patches try to avoid or fix kabi change caused by Intel AMX PR: https://gitee.com/openeuler/kernel/pulls/58 Zheng Zengkai (4): x86: Avoid kabi change caused by adding pkru element in thread_struct x86/extable: Avoid kabi change caused by exception table rework x86/fpu: Avoid kabi change caused by struct fpu mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64 arch/x86/include/asm/extable.h | 4 ++++ arch/x86/include/asm/fpu/types.h | 4 ++++ arch/x86/include/asm/processor.h | 2 ++ arch/x86/include/uapi/asm/auxvec.h | 1 + include/linux/mm_types.h | 15 +++++++++++++++ 5 files changed, 26 insertions(+) -- 2.20.1

6 15

[PATCH openEuler-1.0-LTS] nfp: fix use-after-free in area_cache_get()
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Jialiang Wang <wangjialiang0806(a)163.com> mainline inclusion from mainline-v6.0-rc1 commit 02e1a114fdb71e59ee6770294166c30d437bf86a category: bugfix bugzilla: 187867, https://gitee.com/src-openeuler/kernel/issues/I5W7B5 CVE: CVE-2022-3545 -------------------------------- area_cache_get() is used to distribute cache->area and set cache->id, and if cache->id is not 0 and cache->area->kref refcount is 0, it will release the cache->area by nfp_cpp_area_release(). area_cache_get() set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire(). But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is is already set but the refcount is not increased as expected. At this time, calling the nfp_cpp_area_release() will cause use-after-free. To avoid the use-after-free, set cache->id after area_init() and nfp_cpp_area_acquire() complete successfully. Note: This vulnerability is triggerable by providing emulated device equipped with specified configuration. BUG: KASAN: use-after-free in nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) Write of size 4 at addr ffff888005b7f4a0 by task swapper/0/1 Call Trace: <TASK> nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:884) Allocated by task 1: nfp_cpp_area_alloc_with_name (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:303) nfp_cpp_area_cache_add (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:802) nfp6000_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:1230) nfp_cpp_from_operations (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:1215) nfp_pci_probe (drivers/net/ethernet/netronome/nfp/nfp_main.c:744) Freed by task 1: kfree (mm/slub.c:4562) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:873) nfp_cpp_read (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:924 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:973) nfp_cpp_readl (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cpplib.c:48) Signed-off-by: Jialiang Wang <wangjialiang0806(a)163.com> Reviewed-by: Yinjun Zhang <yinjun.zhang(a)corigine.com> Acked-by: Simon Horman <simon.horman(a)corigine.com> Link: https://lore.kernel.org/r/20220810073057.4032-1-wangjialiang0806@163.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c index 73de57a09800..6f5d69293a25 100644 --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c @@ -872,7 +872,6 @@ area_cache_get(struct nfp_cpp *cpp, u32 id, } /* Adjust the start address to be cache size aligned */ - cache->id = id; cache->addr = addr & ~(u64)(cache->size - 1); /* Re-init to the new ID and address */ @@ -892,6 +891,8 @@ area_cache_get(struct nfp_cpp *cpp, u32 id, return NULL; } + cache->id = id; + exit: /* Adjust offset */ *offset = addr - cache->addr; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] mISDN: fix use-after-free bugs in l1oip timer handlers
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.1-rc1 commit 2568a7e0832ee30b0a351016d03062ab4e0e0a3f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7YH CVE: CVE-2022-3565 -------------------------------- The l1oip_cleanup() traverses the l1oip_ilist and calls release_card() to cleanup module and stack. However, release_card() calls del_timer() to delete the timers such as keep_tl and timeout_tl. If the timer handler is running, the del_timer() will not stop it and result in UAF bugs. One of the processes is shown below: (cleanup routine) | (timer handler) release_card() | l1oip_timeout() ... | del_timer() | ... ... | kfree(hc) //FREE | | hc->timeout_on = 0 //USE Fix by calling del_timer_sync() in release_card(), which makes sure the timer handlers have finished before the resources, such as l1oip and so on, have been deallocated. What's more, the hc->workq and hc->socket_thread can kick those timers right back in. We add a bool flag to show if card is released. Then, check this flag in hc->workq and hc->socket_thread. Fixes: 3712b42d4b1b ("Add layer1 over IP support") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: GUO Zihua <guozihua(a)huawei.com> Reviewed-by: GONG Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 +++++++------ 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/isdn/mISDN/l1oip.h b/drivers/isdn/mISDN/l1oip.h index 7ea10db20e3a..48133d022812 100644 --- a/drivers/isdn/mISDN/l1oip.h +++ b/drivers/isdn/mISDN/l1oip.h @@ -59,6 +59,7 @@ struct l1oip { int bundle; /* bundle channels in one frm */ int codec; /* codec to use for transmis. */ int limit; /* limit number of bchannels */ + bool shutdown; /* if card is released */ /* timer */ struct timer_list keep_tl; diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c index b05022f94f18..2f4a01ab25e8 100644 --- a/drivers/isdn/mISDN/l1oip_core.c +++ b/drivers/isdn/mISDN/l1oip_core.c @@ -289,7 +289,7 @@ l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask, p = frame; /* restart timer */ - if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ)) + if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ) && !hc->shutdown) mod_timer(&hc->keep_tl, jiffies + L1OIP_KEEPALIVE * HZ); else hc->keep_tl.expires = jiffies + L1OIP_KEEPALIVE * HZ; @@ -615,7 +615,9 @@ l1oip_socket_parse(struct l1oip *hc, struct sockaddr_in *sin, u8 *buf, int len) goto multiframe; /* restart timer */ - if (time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || !hc->timeout_on) { + if ((time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || + !hc->timeout_on) && + !hc->shutdown) { hc->timeout_on = 1; mod_timer(&hc->timeout_tl, jiffies + L1OIP_TIMEOUT * HZ); } else /* only adjust timer */ @@ -1247,11 +1249,10 @@ release_card(struct l1oip *hc) { int ch; - if (timer_pending(&hc->keep_tl)) - del_timer(&hc->keep_tl); + hc->shutdown = true; - if (timer_pending(&hc->timeout_tl)) - del_timer(&hc->timeout_tl); + del_timer_sync(&hc->keep_tl); + del_timer_sync(&hc->timeout_tl); cancel_work_sync(&hc->workq); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] tcp: Fix data races around icsk->icsk_af_ops.
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.1-rc1 commit f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7ZF CVE: CVE-2022-3566 -------------------------------- setsockopt(IPV6_ADDRFORM) and tcp_v6_connect() change icsk->icsk_af_ops under lock_sock(), but tcp_(get|set)sockopt() read it locklessly. To avoid load/store tearing, we need to add READ_ONCE() and WRITE_ONCE() for the reads and writes. Thanks to Eric Dumazet for providing the syzbot report: BUG: KCSAN: data-race in tcp_setsockopt / tcp_v6_connect write to 0xffff88813c624518 of 8 bytes by task 23936 on cpu 0: tcp_v6_connect+0x5b3/0xce0 net/ipv6/tcp_ipv6.c:240 __inet_stream_connect+0x159/0x6d0 net/ipv4/af_inet.c:660 inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:724 __sys_connect_file net/socket.c:1976 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1993 __do_sys_connect net/socket.c:2003 [inline] __se_sys_connect net/socket.c:2000 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:2000 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88813c624518 of 8 bytes by task 23937 on cpu 1: tcp_setsockopt+0x147/0x1c80 net/ipv4/tcp.c:3789 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3585 __sys_setsockopt+0x212/0x2b0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 [inline] __se_sys_setsockopt net/socket.c:2260 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffffffff8539af68 -> 0xffffffff8539aff8 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 23937 Comm: syz-executor.5 Not tainted 6.0.0-rc4-syzkaller-00331-g4ed9c1e971b1-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Reported-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/tcp.c net/ipv6/ipv6_sockglue.c net/ipv6/tcp_ipv6.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/tcp.c | 10 ++++++---- net/ipv6/ipv6_sockglue.c | 3 ++- net/ipv6/tcp_ipv6.c | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 325a1dafbd90..094cd93e50c2 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3114,8 +3114,9 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval, const struct inet_connection_sock *icsk = inet_csk(sk); if (level != SOL_TCP) - return icsk->icsk_af_ops->setsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect() */ + return READ_ONCE(icsk->icsk_af_ops)->setsockopt(sk, level, optname, + optval, optlen); return do_tcp_setsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_setsockopt); @@ -3635,8 +3636,9 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval, struct inet_connection_sock *icsk = inet_csk(sk); if (level != SOL_TCP) - return icsk->icsk_af_ops->getsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect() */ + return READ_ONCE(icsk->icsk_af_ops)->getsockopt(sk, level, optname, + optval, optlen); return do_tcp_getsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_getsockopt); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index d3f3a2f79646..85e5bdfa1f87 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -231,7 +231,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, sock_prot_inuse_add(net, &tcp_prot, 1); local_bh_enable(); sk->sk_prot = &tcp_prot; - icsk->icsk_af_ops = &ipv4_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv4_specific); sk->sk_socket->ops = &inet_stream_ops; sk->sk_family = PF_INET; tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index de2975175503..ab9e022325e7 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -229,7 +229,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, sin.sin_port = usin->sin6_port; sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3]; - icsk->icsk_af_ops = &ipv6_mapped; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_mapped); sk->sk_backlog_rcv = tcp_v4_do_rcv; #ifdef CONFIG_TCP_MD5SIG tp->af_specific = &tcp_sock_ipv6_mapped_specific; @@ -239,7 +240,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, if (err) { icsk->icsk_ext_hdr_len = exthdrlen; - icsk->icsk_af_ops = &ipv6_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_specific); sk->sk_backlog_rcv = tcp_v6_do_rcv; #ifdef CONFIG_TCP_MD5SIG tp->af_specific = &tcp_sock_ipv6_specific; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Maxim Mikityanskiy <maxtram95(a)gmail.com> mainline inclusion from bluetooth-next commit 89f9f3cb86b1c63badaf392a83dd661d56cc50b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7XW CVE: CVE-2022-3564 -------------------------------- Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) -> __sock_queue_rcv_skb. 2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram. An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2cap_reassemble_sdu can't use the SKB after that function returns. However, some places continue accessing struct l2cap_ctrl that resides in the SKB's CB for a short time after l2cap_reassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8). Fix it by keeping a local copy of struct l2cap_ctrl. BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169 Workqueue: hci0 hci_rx_work [bluetooth] Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth ret_from_fork (arch/x86/entry/entry_64.S:306) </TASK> Allocated by task 43169: kasan_save_stack (mm/kasan/common.c:39) __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) __alloc_skb (net/core/skbuff.c:414) l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth process_one_work (kernel/workqueue.c:2289) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:306) Freed by task 27920: kasan_save_stack (mm/kasan/common.c:39) kasan_set_track (mm/kasan/common.c:45) kasan_set_free_info (mm/kasan/generic.c:372) ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328) slab_free_freelist_hook (mm/slub.c:1780) kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553) skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth sock_read_iter (net/socket.c:1087) new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401) vfs_read (fs/read_write.c:482) ksys_read (fs/read_write.c:620) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) Link: https://lore.kernel.org/linux-bluetooth/CAKErNvoqga1WcmoR3-0875esY6TVWFQDan… Fixes: d2a7ac5d5d3a ("Bluetooth: Add the ERTM receive state machine") Fixes: 4b51dae96731 ("Bluetooth: Add streaming mode receive and incoming packet classifier") Signed-off-by: Maxim Mikityanskiy <maxtram95(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> conflicts： net/bluetooth/l2cap_core.c Signed-off-by: Xia Longlong <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/l2cap_core.c | 48 ++++++++++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 38789494867d..436a92e3bf20 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6204,6 +6204,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan, struct l2cap_ctrl *control, struct sk_buff *skb, u8 event) { + struct l2cap_ctrl local_control; int err = 0; bool skb_in_use = false; @@ -6228,15 +6229,32 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan, chan->buffer_seq = chan->expected_tx_seq; skb_in_use = true; + /* l2cap_reassemble_sdu may free skb, hence invalidate + * control, so make a copy in advance to use it after + * l2cap_reassemble_sdu returns and to avoid the race + * condition, for example: + * + * The current thread calls: + * l2cap_reassemble_sdu + * chan->ops->recv == l2cap_sock_recv_cb + * __sock_queue_rcv_skb + * Another thread calls: + * bt_sock_recvmsg + * skb_recv_datagram + * skb_free_datagram + * Then the current thread tries to access control, but + * it was freed by skb_free_datagram. + */ + local_control = *control; err = l2cap_reassemble_sdu(chan, skb, control); if (err) break; - if (control->final) { + if (local_control.final) { if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) { - control->final = 0; - l2cap_retransmit_all(chan, control); + local_control.final = 0; + l2cap_retransmit_all(chan, &local_control); l2cap_ertm_send(chan); } } @@ -6616,11 +6634,27 @@ static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, struct sk_buff *skb) { + /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store + * the txseq field in advance to use it after l2cap_reassemble_sdu + * returns and to avoid the race condition, for example: + * + * The current thread calls: + * l2cap_reassemble_sdu + * chan->ops->recv == l2cap_sock_recv_cb + * __sock_queue_rcv_skb + * Another thread calls: + * bt_sock_recvmsg + * skb_recv_datagram + * skb_free_datagram + * Then the current thread tries to access control, but it was freed by + * skb_free_datagram. + */ + u16 txseq = control->txseq; + BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, chan->rx_state); - if (l2cap_classify_txseq(chan, control->txseq) == - L2CAP_TXSEQ_EXPECTED) { + if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) { l2cap_pass_to_tx(chan, control); BT_DBG("buffer_seq %d->%d", chan->buffer_seq, @@ -6643,8 +6677,8 @@ static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, } } - chan->last_acked_seq = control->txseq; - chan->expected_tx_seq = __next_seq(chan, control->txseq); + chan->last_acked_seq = txseq; + chan->expected_tx_seq = __next_seq(chan, txseq); return 0; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] bnx2x: fix potential memory leak in bnx2x_tpa_stop()
by Yongqiang Liu 24 Oct '22

24 Oct '22

From: Jianglei Nie <niejianglei2021(a)163.com> mainline inclusion from mainline-v6.1-rc1 commit b43f9acbb8942b05252be83ac25a81cec70cc192 category: bugfix bugzilla: 187839, https://gitee.com/src-openeuler/kernel/issues/I5W7B1 CVE: CVE-2022-3542 -------------------------------- bnx2x_tpa_stop() allocates a memory chunk from new_data with bnx2x_frag_alloc(). The new_data should be freed when gets some error. But when "pad + len > fp->rx_buf_size" is true, bnx2x_tpa_stop() returns without releasing the new_data, which will lead to a memory leak. We should free the new_data with bnx2x_frag_free() when "pad + len > fp->rx_buf_size" is true. Fixes: 07b0f00964def8af9321cfd6c4a7e84f6362f728 ("bnx2x: fix possible panic under memory stress") Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index cf01e73d1bcc..a123f1733a59 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -788,6 +788,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, BNX2X_ERR("skb_put is about to fail... pad %d len %d rx_buf_size %d\n", pad, len, fp->rx_buf_size); bnx2x_panic(); + bnx2x_frag_free(fp, new_data); return; } #endif -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] r8152: Rate limit overflow messages
by Yongqiang Liu 21 Oct '22

21 Oct '22

From: Andrew Gaul <gaul(a)gaul.org> mainline inclusion from mainline-v6.1-rc1 commit 93e2be344a7db169b7119de21ac1bf253b8c6907 category: bugfix bugzilla: 187847, https://gitee.com/src-openeuler/kernel/issues/I5WFKR CVE: CVE-2022-3594 -------------------------------- My system shows almost 10 million of these messages over a 24-hour period which pollutes my logs. Signed-off-by: Andrew Gaul <gaul(a)google.com> Link: https://lore.kernel.org/r/20221002034128.2026653-1-gaul@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/usb/r8152.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c index 91d47a714afd..f28fc023c8b7 100644 --- a/drivers/net/usb/r8152.c +++ b/drivers/net/usb/r8152.c @@ -1386,7 +1386,9 @@ static void intr_callback(struct urb *urb) "Stop submitting intr, status %d\n", status); return; case -EOVERFLOW: - netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n"); + if (net_ratelimit()) + netif_info(tp, intr, tp->netdev, + "intr status -EOVERFLOW\n"); goto resubmit; /* -EPIPE: should clear the halt */ default: -- 2.25.1

1 0

openEuler Kernel SIG例会
by openEuler conference 20 Oct '22

20 Oct '22

您好！ Kernel SIG 邀请您参加 2022-10-21 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.22.03-LTS-SP1 支持generic VDPA device介绍； 2.openEuler-22.03-LTS-SP1信息同步； 3.kernel SIG committer推举会议链接：https://us06web.zoom.us/j/85064426665?pwd=cDkyZ25DVDNwZXdJWUx0emVxQWR2QT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-10-21 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.22.03-LTS-SP1 支持generic VDPA device介绍； 2.openEuler-22.03-LTS-SP1信息同步； 3.kernel SIG committer推举 You can join the meeting at https://us06web.zoom.us/j/85064426665?pwd=cDkyZ25DVDNwZXdJWUx0emVxQWR2QT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] tcp/udp: Fix memory leak in ipv6_renew_options().
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.1-rc1 commit 3c52c6bb831f6335c176a0fc7214e26f43adbd11 category: bugfix bugzilla: 187825, https://gitee.com/src-openeuler/kernel/issues/I5VZ0J CVE: CVE-2022-3524 -------------------------------- syzbot reported a memory leak [0] related to IPV6_ADDRFORM. The scenario is that while one thread is converting an IPv6 socket into IPv4 with IPV6_ADDRFORM, another thread calls do_ipv6_setsockopt() and allocates memory to inet6_sk(sk)->XXX after conversion. Then, the converted sk with (tcp|udp)_prot never frees the IPv6 resources, which inet6_destroy_sock() should have cleaned up. setsockopt(IPV6_ADDRFORM) setsockopt(IPV6_DSTOPTS) +-----------------------+ +----------------------+ - do_ipv6_setsockopt(sk, ...) - sockopt_lock_sock(sk) - do_ipv6_setsockopt(sk, ...) - lock_sock(sk) ^._ called via tcpv6_prot - WRITE_ONCE(sk->sk_prot, &tcp_prot) before WRITE_ONCE() - xchg(&np->opt, NULL) - txopt_put(opt) - sockopt_release_sock(sk) - release_sock(sk) - sockopt_lock_sock(sk) - lock_sock(sk) - ipv6_set_opt_hdr(sk, ...) - ipv6_update_options(sk, opt) - xchg(&inet6_sk(sk)->opt, opt) ^._ opt is never freed. - sockopt_release_sock(sk) - release_sock(sk) Since IPV6_DSTOPTS allocates options under lock_sock(), we can avoid this memory leak by testing whether sk_family is changed by IPV6_ADDRFORM after acquiring the lock. This issue exists from the initial commit between IPV6_ADDRFORM and IPV6_PKTOPTIONS. [0]: BUG: memory leak unreferenced object 0xffff888009ab9f80 (size 96): comm "syz-executor583", pid 328, jiffies 4294916198 (age 13.034s) hex dump (first 32 bytes): 01 00 00 00 48 00 00 00 08 00 00 00 00 00 00 00 ....H........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002ee98ae1>] kmalloc include/linux/slab.h:605 [inline] [<000000002ee98ae1>] sock_kmalloc+0xb3/0x100 net/core/sock.c:2566 [<0000000065d7b698>] ipv6_renew_options+0x21e/0x10b0 net/ipv6/exthdrs.c:1318 [<00000000a8c756d7>] ipv6_set_opt_hdr net/ipv6/ipv6_sockglue.c:354 [inline] [<00000000a8c756d7>] do_ipv6_setsockopt.constprop.0+0x28b7/0x4350 net/ipv6/ipv6_sockglue.c:668 [<000000002854d204>] ipv6_setsockopt+0xdf/0x190 net/ipv6/ipv6_sockglue.c:1021 [<00000000e69fdcf8>] tcp_setsockopt+0x13b/0x2620 net/ipv4/tcp.c:3789 [<0000000090da4b9b>] __sys_setsockopt+0x239/0x620 net/socket.c:2252 [<00000000b10d192f>] __do_sys_setsockopt net/socket.c:2263 [inline] [<00000000b10d192f>] __se_sys_setsockopt net/socket.c:2260 [inline] [<00000000b10d192f>] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2260 [<000000000a80d7aa>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<000000000a80d7aa>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<000000004562b5c6>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv6/ipv6_sockglue.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index b2e03e84a2df..d3f3a2f79646 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -168,6 +168,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, rtnl_lock(); lock_sock(sk); + /* Another thread has converted the socket into IPv4 with + * IPV6_ADDRFORM concurrently. + */ + if (unlikely(sk->sk_family != AF_INET6)) + goto unlock; + switch (optname) { case IPV6_ADDRFORM: @@ -915,6 +921,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; } +unlock: release_sock(sk); if (needs_rtnl) rtnl_unlock(); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] net: mvpp2: fix mvpp2 debugfs leak
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: "Russell King (Oracle)" <rmk+kernel(a)armlinux.org.uk> mainline inclusion from mainline-v6.0-rc7 commit 0152dfee235e87660f52a117fc9f70dc55956bb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7AX CVE: CVE-2022-3535 -------------------------------- When mvpp2 is unloaded, the driver specific debugfs directory is not removed, which technically leads to a memory leak. However, this directory is only created when the first device is probed, so the hardware is present. Removing the module is only something a developer would to when e.g. testing out changes, so the module would be reloaded. So this memory leak is minor. The original attempt in commit fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") that was labelled as a memory leak fix was not, it fixed a refcount leak, but in doing so created a problem when the module is reloaded - the directory already exists, but mvpp2_root is NULL, so we lose all debugfs entries. This fix has been reverted. This is the alternative fix, where we remove the offending directory whenever the driver is unloaded. Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Parser") Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Marcin Wojtas <mw(a)semihalf.com> Link: https://lore.kernel.org/r/E1ofOAB-00CzkG-UO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/marvell/mvpp2/mvpp2.h drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 ++++++++-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 ++++++++++++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h index 46911b67b039..23f60bc5d48f 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h @@ -1107,5 +1107,6 @@ void mvpp2_percpu_write_relaxed(struct mvpp2 *priv, int cpu, u32 offset, void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name); void mvpp2_dbgfs_cleanup(struct mvpp2 *priv); +void mvpp2_dbgfs_exit(void); #endif diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c index f9744a61e5dd..d77414e1e704 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c @@ -660,6 +660,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent, return 0; } +static struct dentry *mvpp2_root; + +void mvpp2_dbgfs_exit(void) +{ + debugfs_remove(mvpp2_root); +} + void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) { debugfs_remove_recursive(priv->dbgfs_dir); @@ -667,10 +674,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) { - struct dentry *mvpp2_dir, *mvpp2_root; + struct dentry *mvpp2_dir; int ret, i; - mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL); if (!mvpp2_root) { mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); if (IS_ERR(mvpp2_root)) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index 04bee450eb3d..beb79455adc7 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -5412,7 +5412,18 @@ static struct platform_driver mvpp2_driver = { }, }; -module_platform_driver(mvpp2_driver); +static int __init mvpp2_driver_init(void) +{ + return platform_driver_register(&mvpp2_driver); +} +module_init(mvpp2_driver_init); + +static void __exit mvpp2_driver_exit(void) +{ + platform_driver_unregister(&mvpp2_driver); + mvpp2_dbgfs_exit(); +} +module_exit(mvpp2_driver_exit); MODULE_DESCRIPTION("Marvell PPv2 Ethernet Driver - www.marvell.com"); MODULE_AUTHOR("Marcin Wojtas <mw(a)semihalf.com>"); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] kcm: avoid potential race in kcm_tx_work
by Yongqiang Liu 19 Oct '22

19 Oct '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.1-rc1 commit ec7eede369fe5b0d085ac51fdbb95184f87bfc6c category: bugfix bugzilla: 187823, https://gitee.com/src-openeuler/kernel/issues/I5VZ0N CVE: CVE-2022-3521 -------------------------------- syzbot found that kcm_tx_work() could crash [1] in: /* Primarily for SOCK_SEQPACKET sockets */ if (likely(sk->sk_socket) && test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { <<*>> clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); sk->sk_write_space(sk); } I think the reason is that another thread might concurrently run in kcm_release() and call sock_orphan(sk) while sk is not locked. kcm_tx_work() find sk->sk_socket being NULL. [1] BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: null-ptr-deref in kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 Write of size 8 at addr 0000000000000008 by task kworker/u4:3/53 CPU: 0 PID: 53 Comm: kworker/u4:3 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: kkcmd kcm_tx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_write include/linux/instrumented.h:86 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Link: https://lore.kernel.org/r/20221012133412.519394-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/kcm/kcmsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index b919db02c7f9..dd83837f0fbf 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1839,10 +1839,10 @@ static int kcm_release(struct socket *sock) kcm = kcm_sk(sk); mux = kcm->mux; + lock_sock(sk); sock_orphan(sk); kfree_skb(kcm->seq_skb); - lock_sock(sk); /* Purge queue under lock to avoid race condition with tx_work trying * to act when queue is nonempty. If tx_work runs after this point * it will just return. -- 2.25.1

1 0

[PATCH openEuler-5.10 01/47] add config to control detecting conflict of opening block device
by Zheng Zengkai 19 Oct '22

19 Oct '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I53Q6M CVE: NA -------------------------------- We have a feature to add info when opening a write opend block device exclusively. Now we need to add switch to control it. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Chao Liu <liuchao173(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/Kconfig | 7 +++++++ fs/block_dev.c | 10 ++++++++++ include/linux/blk_types.h | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/block/Kconfig b/block/Kconfig index a2297edfdde8..e5c965f1ea25 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -202,6 +202,13 @@ config BLK_INLINE_ENCRYPTION_FALLBACK by falling back to the kernel crypto API when inline encryption hardware is not present. +config BLK_DEV_DUMPINFO + bool "Enable detecting conflict of opening block device" + default n + help + Dump info when open an write opened block device exclusively + or open an exclusive opened device for write + menu "Partition Types" source "block/partitions/Kconfig" diff --git a/fs/block_dev.c b/fs/block_dev.c index c8a3c93cc256..c55181b4a665 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1479,6 +1479,7 @@ int bdev_disk_changed(struct block_device *bdev, bool invalidate) */ EXPORT_SYMBOL_GPL(bdev_disk_changed); +#ifdef CONFIG_BLK_DEV_DUMPINFO static void blkdev_dump_conflict_opener(struct block_device *bdev, char *msg) { char name[BDEVNAME_SIZE]; @@ -1512,6 +1513,7 @@ static bool is_conflict_excl_open(struct block_device *bdev, struct block_device return !!whole->bd_write_openers; } +#endif /* * bd_mutex locking: * @@ -1631,6 +1633,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (for_part) bdev->bd_part_count++; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers++; @@ -1638,9 +1641,11 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, bdev->bd_contains->bd_part_write_openers++; spin_unlock(&bdev_lock); } +#endif if (claiming) { spin_lock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO /* * Open an write opened block device exclusively, the * writing process may probability corrupt the device, @@ -1649,8 +1654,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (is_conflict_excl_open(bdev, claiming, mode)) blkdev_dump_conflict_opener(bdev, "VFS: Open an write opened " "block device exclusively"); +#endif bd_finish_claiming(bdev, claiming, holder); spin_unlock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO } else if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); /* @@ -1663,6 +1670,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, blkdev_dump_conflict_opener(bdev, "VFS: Open an exclusive opened " "block device for write"); spin_unlock(&bdev_lock); +#endif } /* @@ -1881,6 +1889,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) if (for_part) bdev->bd_part_count--; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers--; @@ -1888,6 +1897,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) bdev->bd_contains->bd_part_write_openers--; spin_unlock(&bdev_lock); } +#endif if (!--bdev->bd_openers) { WARN_ON_ONCE(bdev->bd_holders); diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index bbb62ff84601..fbea6b0aef3e 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -48,7 +48,7 @@ struct block_device { int bd_fsfreeze_count; /* Mutex for freeze */ struct mutex bd_fsfreeze_mutex; -#ifndef __GENKSYMS__ +#if defined(CONFIG_BLK_DEV_DUMPINFO) && !defined(__GENKSYMS__) KABI_USE2(1, int bd_write_openers, int bd_part_write_openers); #else KABI_RESERVE(1) -- 2.20.1

1 46

[PATCH openEuler-5.10-LTS 000/168] Backport 5.10.122 LTS
by Zheng Zengkai 18 Oct '22

18 Oct '22

Backport 5.10.122 LTS patches from upstream. git cherry-pick v5.10.121..v5.10.122~1 -s Already merged(-6): 36ee9ffca8ef driver core: fix deadlock in __device_attach 6d8d3f68cbec ubi: ubi_create_volume: Fix use-after-free when volume creation failed c0868f6e728c nbd: call genl_unregister_family() first in nbd_cleanup() 122e4adaff24 nbd: fix race between nbd_alloc_config() and module removal f72df77600a4 nbd: fix io hung while disconnecting device 3be74fc0afbe powerpc/32: Fix overread/overwrite of thread_struct via ptrace Total patches: 174 - 6 = 168 Adrian Hunter (1): mmc: block: Fix CQE recovery reset success Alexander Lobakin (1): modpost: fix removing numeric suffixes Alexandru Tachici (1): iio: adc: ad7124: Remove shift from scan_type Alexey Kardashevskiy (1): powerpc/mm: Switch obsolete dssall to .long Andre Przywara (1): clocksource/drivers/sp804: Avoid error on multiple instances Baokun Li (1): jffs2: fix memory leak in jffs2_do_fill_super Bjorn Andersson (1): usb: typec: mux: Check dev_set_name() return value Brian Norris (2): drm/bridge: analogix_dp: Support PSR-exit to disable transition drm/atomic: Force bridge self-refresh-exit on CRTC switch Cameron Berkenpas (1): ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 Changbin Du (1): sysrq: do not omit current cpu when showing backtrace of all active CPUs Changcheng Liu (1): net/mlx5: correct ECE offset in query qp output Christian Borntraeger (1): s390/gmap: voluntarily schedule during key setting Christophe JAILLET (1): staging: fieldbus: Fix the error handling path in anybuss_host_common_probe() Chuck Lever (1): SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() Cixi Geng (2): iio: adc: sc27xx: fix read big scale voltage not right iio: adc: sc27xx: Fine tune the scale calibration values Damien Le Moal (2): scsi: sd: Fix potential NULL pointer dereference zonefs: fix handling of explicit_open option on mount Dan Carpenter (1): net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() Daniel Gibson (1): tty: n_tty: Restore EOF push handling behavior Dave Jiang (2): dmaengine: idxd: set DMA_INTERRUPT cap bit dmaengine: idxd: add missing callback function to support DMA_INTERRUPT David Howells (1): afs: Fix infinite loop found by xfstest generic/676 Dongliang Mu (1): f2fs: remove WARN_ON in f2fs_is_valid_blkaddr Duoming Zhou (4): drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() drivers: tty: serial: Fix deadlock in sa1100_set_termios() drivers: usb: host: Fix deadlock in oxu_bus_suspend() Eric Dumazet (3): tcp: tcp_rtx_synack() can be called from process context bpf, arm64: Clear prog->jited_len along prog->jited tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd Evan Green (1): USB: hcd-pci: Fully suspend across freeze/thaw cycle Feras Daoud (1): net/mlx5: Rearm the FW tracer after each tracer event Florian Westphal (1): netfilter: nat: really support inet nat without l3 address Gal Pressman (1): net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure Gong Yuanjun (2): mips: cpc: Fix refcount leak in mips_cpc_default_phys_base drm/radeon: fix a possible null pointer dereference Greg Ungerer (2): m68knommu: set ZERO_PAGE() to the allocated zeroed page m68knommu: fix undefined reference to `_init_sp' Guangguan Wang (1): net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" Guilherme G. Piccoli (1): coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier Guoju Fang (1): net: sched: add barrier to fix packet stuck problem for lockless qdisc Guoqing Jiang (1): md: protect md_unregister_thread from reentrancy Haibo Chen (1): gpio: pca953x: use the correct register address to do regcache sync Hangyu Hua (1): usb: usbip: fix a refcount leak in stub_probe() Hannes Reinecke (1): scsi: myrb: Fix up null pointer access on myrb_cleanup() Hao Luo (1): kernfs: Separate kernfs_pr_cont_buf and rename_lock. Heinrich Schuchardt (1): riscv: read-only pages should not be writable Hoang Le (1): tipc: check attribute length for bearer name Huang Guobin (1): tty: Fix a possible resource leak in icom_probe Ilpo Järvinen (8): serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 serial: digicolor-usart: Don't allow CS5-6 serial: rda-uart: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: sh-sci: Don't allow CS5-6 serial: sifive: Sanitize CSIZE and c_iflag serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 serial: stm32-usart: Correct CSIZE, bits, and parity Jakob Koschel (1): staging: greybus: codecs: fix type confusion of list iterator variable Jann Horn (1): s390/crypto: fix scatterwalk_unmap() callers in AES-GCM Jiasheng Jiang (1): lkdtm/bugs: Check for the NULL pointer after calling kmalloc Johan Hovold (2): phy: qcom-qmp: fix pipe-clock imbalance on power-on failure PCI: qcom: Fix pipe clock imbalance John Ogness (2): serial: meson: acquire port->lock in startup() serial: msm_serial: disable interrupts in __msm_console_write() Jun Miao (1): tracing: Fix sleeping function called from invalid context on RT kernel Kees Cook (2): lkdtm/usercopy: Expand size of "out of frame" object nodemask: Fix return values to be unsigned Kinglong Mee (1): xprtrdma: treat all calls not a bcall when bc_serv is NULL Krzysztof Kozlowski (3): rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value Kuan-Ying Lee (1): scripts/gdb: change kernel config dumping method Kuniyuki Iwashima (1): af_unix: Fix a data-race in unix_dgram_peer_wake_me(). Leo Yan (1): perf c2c: Fix sorting in percent_rmt_hitm_cmp() Leon Romanovsky (1): net/mlx5: Don't use already freed action pointer Li Jun (1): extcon: ptn5150: Add queue work sync before driver release Lin Ma (1): USB: storage: karma: fix rio_karma_init return Linus Torvalds (1): drm: imx: fix compiler warning with gcc-12 Liu Xinpeng (1): watchdog: wdat_wdt: Stop watchdog when rebooting the system Lucas Tanure (1): i2c: cadence: Increase timeout per message if necessary Maciej W. Rozycki (1): serial: sifive: Report actual baud base rather than fixed 115200 Marek Szyprowski (1): usb: dwc2: gadget: don't reset gadget's driver->bus Mark Bloch (1): net/mlx5: fs, fail conflicting actions Mark-PK Tsai (1): tracing: Avoid adding tracer option before update_tracer_options Martin Faltesek (3): nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION Martin Habets (1): sfc: fix considering that all channels have TX queues Masahiro Yamada (5): xen: unexport __init-annotated xen_xlate_map_ballooned_pages() net: mdio: unexport __init-annotated mdio_bus_init() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: ipv6: unexport __init-annotated seg6_hmac_init() modpost: fix undefined behavior of is_arm_mapping_symbol() Masami Hiramatsu (1): bootconfig: Make the bootconfig.o as a normal object file Mathias Nyman (1): Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag Maxim Mikityanskiy (1): net/mlx5e: Update netdev features after changing XDP state Menglong Dong (1): bpf: Fix probe read error in ___bpf_prog_run() Miaoqian Lin (13): tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe usb: musb: Fix missing of_node_put() in omap2430_probe iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout soc: rockchip: Fix refcount leak in rockchip_grf_init firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list net: altera: Fix refcount leak in altera_tse_mdio_create Michael Ellerman (1): powerpc/kasan: Force thread size increase with KASAN Michal Kubecek (1): Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" Miquel Raynal (1): iio: st_sensors: Add a local lock for protecting odr Niels Dossche (1): usb: usbip: add missing device lock on tweak configuration cmd Olivier Matz (2): ixgbe: fix bcast packets Rx on VF after promisc removal ixgbe: fix unexpected VLAN Rx in promisc mode on VF Pablo Neira Ayuso (5): netfilter: nf_tables: delete flowtable hooks via transaction list netfilter: nf_tables: always initialize flowtable hook list in transaction netfilter: nf_tables: release new hooks on unsupported flowtable flags netfilter: nf_tables: memleak flow rule from commit path netfilter: nf_tables: bail out early if hardware offload is not supported Pascal Hambourg (1): md/raid0: Ignore RAID0 layout if the second zone has only one device Paulo Alcantara (1): cifs: fix reconnect on smb3 mount types Peter Zijlstra (2): x86/cpu: Elide KCSAN for cpu_has() and friends jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds Radhey Shyam Pandey (1): dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type Randy Dunlap (1): pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards Samuel Holland (1): clocksource/drivers/riscv: Events are stopped during CPU suspend Saravana Kannan (1): driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction Saurabh Sengar (1): video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 Schspa Shi (1): driver: base: fix UAF when driver_attach failed Sergey Shtylyov (1): ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files Shengjiu Wang (1): ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition Sherry Sun (1): tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get Shuah Khan (1): misc: rtsx: set NULL intfdata when probe fails Shyam Prasad N (1): cifs: return errors during session setup during reconnects Stephen Boyd (2): interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: Restore sync state by ignoring ipa-virt in provider count Steve French (1): cifs: version operations for smb20 unneeded when legacy support disabled Tan Tee Min (1): net: phy: dp83867: retrigger SGMII AN when link change Tony Lindgren (1): bus: ti-sysc: Fix warnings for unbind for serial Trond Myklebust (1): NFSv4: Don't hold the layoutget locks across multiple RPC calls Uwe Kleine-König (1): pwm: lp3943: Fix duty calculation in case period was clamped Venky Shankar (1): ceph: allow ceph.dir.rctime xattr to be updatable Vincent Ray (1): net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog Wang Cheng (2): staging: rtl8712: fix uninit-value in usb_read8() and friends staging: rtl8712: fix uninit-value in r871xu_drv_init() Wang Weiyang (1): tty: goldfish: Use tty_port_destroy() to destroy port Willem de Bruijn (1): ip_gre: test csum_start instead of transport header Xiaoke Wang (2): iio: dummy: iio_simple_dummy: check the return value of kstrdup() staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Xiaomeng Tong (2): misc: fastrpc: fix an incorrect NULL check on list iterator firmware: stratix10-svc: fix a missing check on list iterator Xie Yongji (1): vringh: Fix loop descriptors check in the indirect cases Yang Yingliang (4): rtc: mt6397: check return value after calling platform_get_resource() iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() iommu/arm-smmu-v3: check return value after calling platform_get_resource() video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() Yu Xiao (1): nfp: only report pause frame configuration for physical device Zhen Ni (1): USB: host: isp116x: check return value after calling platform_get_resource() Zheng Yongjun (1): usb: dwc3: pci: Fix pm_runtime_get_sync() error checking Zheyu Ma (1): tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Zhihao Cheng (1): ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty bumwoo lee (1): extcon: Modify extcon device to be created after driver data is set huangwenhui (1): ALSA: hda/conexant - Fix loopback issue with CX20632 Íñigo Huguet (1): sfc: fix wrong tx channel offset with efx_separate_tx_channels Documentation/ABI/testing/sysfs-ata | 11 ++-- arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.machine | 1 + arch/m68k/include/asm/pgtable_no.h | 3 +- arch/mips/kernel/mips-cpc.c | 1 + arch/powerpc/Kconfig | 1 - arch/powerpc/include/asm/ppc-opcode.h | 2 + arch/powerpc/include/asm/thread_info.h | 10 +++- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/kernel/idle_6xx.S | 2 +- arch/powerpc/kernel/l2cr_6xx.S | 6 +-- arch/powerpc/kernel/swsusp_32.S | 2 +- arch/powerpc/kernel/swsusp_asm64.S | 2 +- arch/powerpc/mm/mmu_context.c | 2 +- arch/powerpc/platforms/powermac/cache.S | 4 +- arch/riscv/kernel/efi.c | 2 +- arch/s390/crypto/aes_s390.c | 4 +- arch/s390/mm/gmap.c | 14 +++++ arch/x86/include/asm/cpufeature.h | 2 +- drivers/ata/libata-transport.c | 2 +- drivers/ata/pata_octeon_cf.c | 3 ++ drivers/base/bus.c | 4 +- drivers/base/dd.c | 5 -- drivers/bus/ti-sysc.c | 4 +- drivers/clocksource/timer-oxnas-rps.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/clocksource/timer-sp804.c | 10 ++-- drivers/dma/idxd/dma.c | 23 ++++++++ drivers/dma/xilinx/zynqmp_dma.c | 5 +- drivers/extcon/extcon-ptn5150.c | 11 ++++ drivers/extcon/extcon.c | 29 +++++----- drivers/firmware/dmi-sysfs.c | 2 +- drivers/firmware/stratix10-svc.c | 12 ++--- drivers/gpio/gpio-pca953x.c | 19 ++++--- .../drm/bridge/analogix/analogix_dp_core.c | 42 +++++++++++++-- drivers/gpu/drm/drm_atomic_helper.c | 16 ++++-- drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++ .../hwtracing/coresight/coresight-cpu-debug.c | 7 +-- drivers/i2c/busses/i2c-cadence.c | 12 ++++- drivers/iio/adc/ad7124.c | 1 - drivers/iio/adc/sc27xx_adc.c | 20 +++---- drivers/iio/adc/stmpe-adc.c | 8 +-- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++--- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++--- drivers/iio/proximity/vl53l0x-i2c.c | 7 ++- drivers/input/mouse/bcm5974.c | 7 ++- drivers/interconnect/core.c | 7 ++- drivers/interconnect/qcom/sc7180.c | 21 -------- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu.c | 5 +- drivers/md/md.c | 15 ++++-- drivers/md/raid0.c | 31 +++++------ drivers/misc/cardreader/rtsx_usb.c | 1 + drivers/misc/fastrpc.c | 9 ++-- drivers/misc/lkdtm/bugs.c | 5 ++ drivers/misc/lkdtm/usercopy.c | 17 ++++-- drivers/mmc/core/block.c | 3 +- drivers/mtd/ubi/ubi.h | 4 +- drivers/net/dsa/lantiq_gswip.c | 4 +- drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/altera/altera_tse_main.c | 6 ++- .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 +-- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 ++ .../net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- .../mellanox/mlx5/core/diag/fw_tracer.c | 7 ++- .../net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++ .../net/ethernet/mellanox/mlx5/core/fs_core.c | 35 ++++++++++-- .../mellanox/mlx5/core/steering/fs_dr.c | 9 ++-- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 4 +- drivers/net/ethernet/sfc/efx_channels.c | 6 +-- drivers/net/ethernet/sfc/net_driver.h | 2 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 +- drivers/net/phy/dp83867.c | 29 ++++++++++ drivers/net/phy/mdio_bus.c | 1 - drivers/nfc/st21nfca/se.c | 53 +++++++++++-------- drivers/pci/controller/dwc/pcie-qcom.c | 6 --- drivers/pcmcia/Kconfig | 2 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- drivers/pwm/pwm-lp3943.c | 1 + drivers/rpmsg/qcom_smd.c | 4 +- drivers/rtc/rtc-mt6397.c | 2 + drivers/scsi/myrb.c | 11 ++-- drivers/scsi/sd.c | 1 - drivers/soc/rockchip/grf.c | 2 + drivers/staging/fieldbus/anybuss/host.c | 2 +- drivers/staging/greybus/audio_codec.c | 4 +- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- .../rtl8192u/ieee80211/ieee80211_softmac.c | 2 +- drivers/staging/rtl8712/os_intfs.c | 1 - drivers/staging/rtl8712/usb_intf.c | 12 ++--- drivers/staging/rtl8712/usb_ops.c | 27 ++++++---- drivers/tty/goldfish.c | 2 + drivers/tty/n_tty.c | 38 ++++++++++++- drivers/tty/serial/8250/8250_fintek.c | 8 +-- drivers/tty/serial/digicolor-usart.c | 2 + drivers/tty/serial/fsl_lpuart.c | 24 ++------- drivers/tty/serial/icom.c | 2 +- drivers/tty/serial/meson_uart.c | 13 +++++ drivers/tty/serial/msm_serial.c | 5 ++ drivers/tty/serial/owl-uart.c | 1 + drivers/tty/serial/rda-uart.c | 2 + drivers/tty/serial/sa1100.c | 4 +- drivers/tty/serial/serial_txx9.c | 2 + drivers/tty/serial/sh-sci.c | 6 ++- drivers/tty/serial/sifive.c | 8 ++- drivers/tty/serial/st-asc.c | 4 ++ drivers/tty/serial/stm32-usart.c | 15 ++++-- drivers/tty/synclink_gt.c | 2 + drivers/tty/sysrq.c | 13 +++-- drivers/usb/core/hcd-pci.c | 4 +- drivers/usb/dwc2/gadget.c | 1 - drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/host/isp116x-hcd.c | 6 ++- drivers/usb/host/oxu210hp-hcd.c | 2 + drivers/usb/musb/omap2430.c | 1 + drivers/usb/storage/karma.c | 15 +++--- drivers/usb/typec/mux.c | 14 +++-- drivers/usb/usbip/stub_dev.c | 2 +- drivers/usb/usbip/stub_rx.c | 2 + drivers/vhost/vringh.c | 10 +++- drivers/video/fbdev/hyperv_fb.c | 19 +------ drivers/video/fbdev/pxa3xx-gcu.c | 12 +++-- drivers/watchdog/rti_wdt.c | 2 +- drivers/watchdog/ts4800_wdt.c | 5 +- drivers/watchdog/wdat_wdt.c | 1 + drivers/xen/xlate_mmu.c | 1 - fs/afs/dir.c | 5 +- fs/ceph/xattr.c | 10 +++- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsfs.h | 2 +- fs/cifs/cifsglob.h | 4 +- fs/cifs/misc.c | 27 ++++++---- fs/cifs/smb2ops.c | 7 ++- fs/cifs/smb2pdu.c | 3 ++ fs/f2fs/checkpoint.c | 4 +- fs/jffs2/fs.c | 1 + fs/kernfs/dir.c | 31 ++++++----- fs/nfs/nfs4proc.c | 4 ++ fs/zonefs/super.c | 11 ++-- include/linux/iio/common/st_sensors.h | 3 ++ include/linux/jump_label.h | 4 +- include/linux/mlx5/mlx5_ifc.h | 5 +- include/linux/nodemask.h | 38 ++++++------- include/net/flow_offload.h | 1 + include/net/netfilter/nf_tables.h | 1 - include/net/netfilter/nf_tables_offload.h | 2 +- include/net/sch_generic.h | 42 +++++---------- kernel/bpf/core.c | 14 ++--- kernel/trace/trace.c | 13 +++-- lib/Makefile | 2 +- lib/nodemask.c | 4 +- net/core/flow_offload.c | 6 +++ net/ipv4/ip_gre.c | 11 ++-- net/ipv4/tcp_input.c | 11 ++-- net/ipv4/tcp_output.c | 4 +- net/ipv4/xfrm4_protocol.c | 1 - net/ipv6/seg6_hmac.c | 1 - net/key/af_key.c | 10 ++-- net/netfilter/nf_tables_api.c | 52 ++++++++---------- net/netfilter/nf_tables_offload.c | 23 +++++++- net/netfilter/nft_nat.c | 3 +- net/smc/smc_cdc.c | 2 +- net/sunrpc/xdr.c | 6 ++- net/sunrpc/xprtrdma/rpc_rdma.c | 5 ++ net/tipc/bearer.c | 3 +- net/unix/af_unix.c | 2 +- scripts/gdb/linux/config.py | 6 +-- scripts/mod/modpost.c | 5 +- sound/pci/hda/patch_conexant.c | 7 +++ sound/pci/hda/patch_realtek.c | 1 + sound/soc/fsl/fsl_sai.h | 4 +- tools/perf/builtin-c2c.c | 4 +- tools/testing/selftests/netfilter/nft_nat.sh | 43 +++++++++++++++ 174 files changed, 946 insertions(+), 508 deletions(-) -- 2.20.1

1 168

[PATCH openEuler-22.03-LTS-Ascend 01/79] mm/sharepool: Support read-only memory allocation
by Zheng Zengkai 18 Oct '22

18 Oct '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> Offering: HULK ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DS9S -------------------------------- When the driver uses the shared pool memory to share the memory with the user space, the user space is not allowed to operate this area. This prevents users from damaging sensitive data. When the sp_alloc and k2u processes apply for private memory, read-only memory can be applied for. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> --- include/linux/share_pool.h | 3 ++- mm/share_pool.c | 18 ++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 6f294911c6af..5539a17da7a9 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -15,6 +15,7 @@ #define SP_HUGEPAGE_ONLY (1 << 1) #define SP_DVPP (1 << 2) #define SP_SPEC_NODE_ID (1 << 3) +#define SP_PROT_RO (1 << 16) #define DEVICE_ID_BITS 4UL #define DEVICE_ID_MASK ((1UL << DEVICE_ID_BITS) - 1UL) @@ -24,7 +25,7 @@ #define NODE_ID_SHIFT (DEVICE_ID_SHIFT + DEVICE_ID_BITS) #define SP_FLAG_MASK (SP_HUGEPAGE | SP_HUGEPAGE_ONLY | SP_DVPP | \ - SP_SPEC_NODE_ID | \ + SP_SPEC_NODE_ID | SP_PROT_RO | \ (DEVICE_ID_MASK << DEVICE_ID_SHIFT) | \ (NODE_ID_MASK << NODE_ID_SHIFT)) diff --git a/mm/share_pool.c b/mm/share_pool.c index 76088952d0a5..99f25a551afc 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2331,6 +2331,9 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, if (spg_node) prot = spg_node->prot; + if (ac->sp_flags & SP_PROT_RO) + prot = PROT_READ; + /* when success, mmap_addr == spa->va_start */ mmap_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(mmap_addr)) { @@ -2355,6 +2358,10 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, ret = -EINVAL; goto unmap; } + + if (ac->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + /* clean PTE_RDONLY flags or trigger SMMU event */ if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); @@ -2650,6 +2657,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, goto put_mm; } + if (kc && kc->sp_flags & SP_PROT_RO) + prot = PROT_READ; + ret_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(ret_addr)) { pr_debug("k2u mmap failed %lx\n", ret_addr); @@ -2662,6 +2672,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); + if (kc && kc->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + if (is_vm_hugetlb_page(vma)) { ret = remap_vmalloc_hugepage_range(vma, (void *)kva, 0); if (ret) { @@ -2713,6 +2726,7 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un struct sp_area *spa; struct spg_proc_stat *stat; unsigned long prot = PROT_READ | PROT_WRITE; + struct sp_k2u_context kc; down_write(&sp_group_sem); stat = sp_init_process_stat(current, current->mm, spg_none); @@ -2731,8 +2745,8 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un } spa->kva = kva; - - uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, NULL); + kc.sp_flags = sp_flags; + uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, &kc); __sp_area_drop(spa); if (IS_ERR(uva)) pr_err("remap k2u to task failed %ld\n", PTR_ERR(uva)); -- 2.20.1

1 78

[PATCH openEuler-5.10-LTS 01/12] mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
by Zheng Zengkai 18 Oct '22

18 Oct '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.141 commit 98f401d36396134c0c86e9e3bd00b6b6b028b521 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5USOP CVE: CVE-2022-42703 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2555283eb40df89945557273121e9393ef9b542b upstream. anon_vma->degree tracks the combined number of child anon_vmas and VMAs that use the anon_vma as their ->anon_vma. anon_vma_clone() then assumes that for any anon_vma attached to src->anon_vma_chain other than src->anon_vma, it is impossible for it to be a leaf node of the VMA tree, meaning that for such VMAs ->degree is elevated by 1 because of a child anon_vma, meaning that if ->degree equals 1 there are no VMAs that use the anon_vma as their ->anon_vma. This assumption is wrong because the ->degree optimization leads to leaf nodes being abandoned on anon_vma_clone() - an existing anon_vma is reused and no new parent-child relationship is created. So it is possible to reuse an anon_vma for one VMA while it is still tied to another VMA. This is an issue because is_mergeable_anon_vma() and its callers assume that if two VMAs have the same ->anon_vma, the list of anon_vmas attached to the VMAs is guaranteed to be the same. When this assumption is violated, vma_merge() can merge pages into a VMA that is not attached to the corresponding anon_vma, leading to dangling page->mapping pointers that will be dereferenced during rmap walks. Fix it by separately tracking the number of child anon_vmas and the number of VMAs using the anon_vma as their ->anon_vma. Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") Cc: stable(a)kernel.org Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/rmap.h | 7 +++++-- mm/rmap.c | 29 ++++++++++++++++------------- 2 files changed, 21 insertions(+), 15 deletions(-) diff --git a/include/linux/rmap.h b/include/linux/rmap.h index 8d04e7deedc6..297744ea4dd0 100644 --- a/include/linux/rmap.h +++ b/include/linux/rmap.h @@ -39,12 +39,15 @@ struct anon_vma { atomic_t refcount; /* - * Count of child anon_vmas and VMAs which points to this anon_vma. + * Count of child anon_vmas. Equals to the count of all anon_vmas that + * have ->parent pointing to this one, including itself. * * This counter is used for making decision about reusing anon_vma * instead of forking new one. See comments in function anon_vma_clone. */ - unsigned degree; + unsigned long num_children; + /* Count of VMAs whose ->anon_vma pointer points to this object. */ + unsigned long num_active_vmas; struct anon_vma *parent; /* Parent of this anon_vma */ diff --git a/mm/rmap.c b/mm/rmap.c index 0dc39cf94345..d0ef90af0567 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -89,7 +89,8 @@ static inline struct anon_vma *anon_vma_alloc(void) anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); if (anon_vma) { atomic_set(&anon_vma->refcount, 1); - anon_vma->degree = 1; /* Reference for first vma */ + anon_vma->num_children = 0; + anon_vma->num_active_vmas = 0; anon_vma->parent = anon_vma; /* * Initialise the anon_vma root to point to itself. If called @@ -197,6 +198,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) anon_vma = anon_vma_alloc(); if (unlikely(!anon_vma)) goto out_enomem_free_avc; + anon_vma->num_children++; /* self-parent link for new root */ allocated = anon_vma; } @@ -206,8 +208,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) if (likely(!vma->anon_vma)) { vma->anon_vma = anon_vma; anon_vma_chain_link(vma, avc, anon_vma); - /* vma reference or self-parent link for new root */ - anon_vma->degree++; + anon_vma->num_active_vmas++; allocated = NULL; avc = NULL; } @@ -292,19 +293,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) anon_vma_chain_link(dst, avc, anon_vma); /* - * Reuse existing anon_vma if its degree lower than two, - * that means it has no vma and only one anon_vma child. + * Reuse existing anon_vma if it has no vma and only one + * anon_vma child. * - * Do not chose parent anon_vma, otherwise first child - * will always reuse it. Root anon_vma is never reused: + * Root anon_vma is never reused: * it has self-parent reference and at least one child. */ if (!dst->anon_vma && src->anon_vma && - anon_vma != src->anon_vma && anon_vma->degree < 2) + anon_vma->num_children < 2 && + anon_vma->num_active_vmas == 0) dst->anon_vma = anon_vma; } if (dst->anon_vma) - dst->anon_vma->degree++; + dst->anon_vma->num_active_vmas++; unlock_anon_vma_root(root); return 0; @@ -354,6 +355,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) anon_vma = anon_vma_alloc(); if (!anon_vma) goto out_error; + anon_vma->num_active_vmas++; avc = anon_vma_chain_alloc(GFP_KERNEL); if (!avc) goto out_error_free_anon_vma; @@ -374,7 +376,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) vma->anon_vma = anon_vma; anon_vma_lock_write(anon_vma); anon_vma_chain_link(vma, avc, anon_vma); - anon_vma->parent->degree++; + anon_vma->parent->num_children++; anon_vma_unlock_write(anon_vma); return 0; @@ -406,7 +408,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) * to free them outside the lock. */ if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) { - anon_vma->parent->degree--; + anon_vma->parent->num_children--; continue; } @@ -414,7 +416,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) anon_vma_chain_free(avc); } if (vma->anon_vma) { - vma->anon_vma->degree--; + vma->anon_vma->num_active_vmas--; /* * vma would still be needed after unlink, and anon_vma will be prepared @@ -432,7 +434,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma) list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { struct anon_vma *anon_vma = avc->anon_vma; - VM_WARN_ON(anon_vma->degree); + VM_WARN_ON(anon_vma->num_children); + VM_WARN_ON(anon_vma->num_active_vmas); put_anon_vma(anon_vma); list_del(&avc->same_vma); -- 2.20.1

1 11

[PATCH openEuler-1.0-LTS] fbdev: smscufx: Fix use-after-free in ufx_ops_open()
by Yongqiang Liu 18 Oct '22

18 Oct '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v6.0-rc1 commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c category: bugfix bugzilla: 187798, https://gitee.com/src-openeuler/kernel/issues/I5U1NZ CVE: CVE-2022-41849 -------------------------------- A race condition may occur if the user physically removes the USB device while calling open() for this device node. This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF. So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions to avoid race contidion of krefs. Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/smscufx.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c index 22b606af0a87..2256e5816090 100644 --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -140,6 +140,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len); static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size); static void ufx_free_urb_list(struct ufx_data *dev); +static DEFINE_MUTEX(disconnect_mutex); + /* reads a control register */ static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data) { @@ -1073,9 +1075,13 @@ static int ufx_ops_open(struct fb_info *info, int user) if (user == 0 && !console) return -EBUSY; + mutex_lock(&disconnect_mutex); + /* If the USB device is gone, we don't accept new opens */ - if (dev->virtualized) + if (dev->virtualized) { + mutex_unlock(&disconnect_mutex); return -ENODEV; + } dev->fb_count++; @@ -1099,6 +1105,8 @@ static int ufx_ops_open(struct fb_info *info, int user) pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d", info->node, user, info, dev->fb_count); + mutex_unlock(&disconnect_mutex); + return 0; } @@ -1747,6 +1755,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) { struct ufx_data *dev; + mutex_lock(&disconnect_mutex); + dev = usb_get_intfdata(interface); pr_debug("USB disconnect starting\n"); @@ -1767,6 +1777,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) kref_put(&dev->kref, ufx_free); /* consider ufx_data freed */ + + mutex_unlock(&disconnect_mutex); } static struct usb_driver ufx_driver = { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] arm64: fix oops in concurrently setting insn_emulation sysctls
by Yongqiang Liu 18 Oct '22

18 Oct '22

From: haibinzhang (张海斌) <haibinzhang(a)tencent.com> stable inclusion from stable-v4.19.256 commit b51881b1da57fe9877125dfdd0aac5172958fcfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5U71M CVE: CVE-2022-20422 --------------------------- [ Upstream commit af483947d472eccb79e42059276c4deed76f99a6 ] emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently with itself: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | vfs_write+0xe4/0x1d0 | ksys_write+0x70/0xf8 | __arm64_sys_write+0x20/0x28 | el0_svc_common.constprop.0+0x7c/0x1c0 | el0_svc_handler+0x2c/0xa0 | el0_svc+0x8/0x200 To fix this issue, keep the table->data as &insn->current_mode and use container_of() to retrieve the insn pointer. Another mutex is used to protect against the current_mode update but not for retrieving insn_emulation as table->data is no longer changing. Co-developed-by: hewenliang <hewenliang4(a)huawei.com> Signed-off-by: hewenliang <hewenliang4(a)huawei.com> Signed-off-by: Haibin Zhang <haibinzhang(a)tencent.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ruanjinjie <ruanjinjie(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/kernel/armv8_deprecated.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c index 0cbf78581974..88d3454f2848 100644 --- a/arch/arm64/kernel/armv8_deprecated.c +++ b/arch/arm64/kernel/armv8_deprecated.c @@ -62,6 +62,7 @@ struct insn_emulation { static LIST_HEAD(insn_emulation); static int nr_insn_emulated __initdata; static DEFINE_RAW_SPINLOCK(insn_emulation_lock); +static DEFINE_MUTEX(insn_emulation_mutex); static void register_emulation_hooks(struct insn_emulation_ops *ops) { @@ -210,10 +211,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write, loff_t *ppos) { int ret = 0; - struct insn_emulation *insn = (struct insn_emulation *) table->data; + struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode); enum insn_emulation_mode prev_mode = insn->current_mode; - table->data = &insn->current_mode; + mutex_lock(&insn_emulation_mutex); ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); if (ret || !write || prev_mode == insn->current_mode) @@ -226,7 +227,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write, update_insn_emulation_mode(insn, INSN_UNDEF); } ret: - table->data = insn; + mutex_unlock(&insn_emulation_mutex); return ret; } @@ -250,7 +251,7 @@ static void __init register_insn_emulation_sysctl(void) sysctl->maxlen = sizeof(int); sysctl->procname = insn->ops->name; - sysctl->data = insn; + sysctl->data = &insn->current_mode; sysctl->extra1 = &insn->min; sysctl->extra2 = &insn->max; sysctl->proc_handler = emulation_proc_handler; -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] init/Kconfig: Add SMP to the dependencies of QOS_SCHED
by Yongqiang Liu 17 Oct '22

17 Oct '22

From: Xia Fukun <xiafukun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UPB0 CVE: NA ------------------------------------------------------------ After CONFIG_SMP is disabled during kernel compilation, CONFIG_QOS_SCHED is not disabled. As a result, the following error occurs: kernel/sched/fair.c: In function ‘check_qos_cfs_rq’: kernel/sched/fair.c:7324:4: error: implicit declaration of function ‘sched_idle_cpu’; did you mean ‘sched_idle_rq’? [-Werror=implicit-function-declaration] 7324 | !sched_idle_cpu(smp_processor_id()) && | ^~~~~~~~~~~~~~ ./include/linux/compiler.h:78:42: note: in definition of macro ‘unlikely’ 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ CC mm/highmem.o kernel/sched/fair.c: In function ‘pick_next_task_fair’: kernel/sched/fair.c:7599:43: error: ‘struct rq’ has no member named ‘online’ 7599 | if (cfs_rq->idle_h_nr_running != 0 && rq->online) | ^~ AR arch/x86/mm/pat/built-in.a CC kernel/sched/stats.o kernel/sched/fair.c:7790:7: error: ‘struct rq’ has no member named ‘idle_stamp’; did you mean ‘idle_state’? 7790 | rq->idle_stamp = 0; | ^~~~~~~~~~ | idle_state This is because the definitions of the corresponding functions and variables depend on the SMP configuration. So add SMP to the dependencies of QOS_SCHED. Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: zheng zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- init/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig b/init/Kconfig index 2c79f2e51fc4..a2a733080fe1 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -791,6 +791,7 @@ config QOS_SCHED bool "Qos task scheduling" depends on CGROUP_SCHED depends on CFS_BANDWIDTH + depends on SMP default n -- 2.25.1

1 1

[PATCH openEuler-5.10 01/12] blk-iocost: don't ignore vrate_min on QD contention
by Zheng Zengkai 14 Oct '22

14 Oct '22

From: Tejun Heo <tj(a)kernel.org> mainline inclusion from mainline-v5.13-rc1 commit f46ec84b5acbf8d7067d71a6bbdde213d4b86036 category: bugfix bugzilla: 187443, https://gitee.com/openeuler/kernel/issues/I5PFPV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- ioc_adjust_base_vrate() ignored vrate_min when rq_wait_pct indicates that there is QD contention. The reasoning was that QD depletion always reliably indicates device saturation and thus it's safe to override user specified vrate_min. However, this sometimes leads to unnecessary throttling, especially on really fast devices, because vrate adjustments have delays and inertia. It also confuses users because the behavior violates the explicitly specified configuration. This patch drops the special case handling so that vrate_min is always applied. Signed-off-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/YIIo1HuyNmhDeiNx@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> confilict: block/blk-iocost.c Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-iocost.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index fb8f959a7f32..08e4ba856e3b 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2341,10 +2341,6 @@ static void ioc_timer_fn(struct timer_list *timer) u64 vrate = ioc->vtime_base_rate; u64 vrate_min = ioc->vrate_min, vrate_max = ioc->vrate_max; - /* rq_wait signal is always reliable, ignore user vrate_min */ - if (rq_wait_pct > RQ_WAIT_BUSY_PCT) - vrate_min = VRATE_MIN; - /* * If vrate is out of bounds, apply clamp gradually as the * bounds can change abruptly. Otherwise, apply busy_level -- 2.20.1

1 11

[PATCH openEuler-1.0-LTS 1/3] HID: roccat: Fix use-after-free in roccat_read()
by Yongqiang Liu 14 Oct '22

14 Oct '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline master commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5U1PE CVE: CVE-2022-41850 -------------------------------- roccat_report_event() is responsible for registering roccat-related reports in struct roccat_device. int roccat_report_event(int minor, u8 const *data) { struct roccat_device *device; struct roccat_reader *reader; struct roccat_report *report; uint8_t *new_value; device = devices[minor]; new_value = kmemdup(data, device->report_size, GFP_ATOMIC); if (!new_value) return -ENOMEM; report = &device->cbuf[device->cbuf_end]; /* passing NULL is safe */ kfree(report->value); ... The registered report is stored in the struct roccat_device member "struct roccat_report cbuf[ROCCAT_CBUF_SIZE];". If more reports are received than the "ROCCAT_CBUF_SIZE" value, kfree() the saved report from cbuf[0] and allocates a new reprot. Since there is no lock when this kfree() is performed, kfree() can be performed even while reading the saved report. static ssize_t roccat_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos) { struct roccat_reader *reader = file->private_data; struct roccat_device *device = reader->device; struct roccat_report *report; ssize_t retval = 0, len; DECLARE_WAITQUEUE(wait, current); mutex_lock(&device->cbuf_lock); ... report = &device->cbuf[reader->cbuf_start]; /* * If report is larger than requested amount of data, rest of report * is lost! */ len = device->report_size > count ? count : device->report_size; if (copy_to_user(buffer, report->value, len)) { retval = -EFAULT; goto exit_unlock; } ... The roccat_read() function receives the device->cbuf report and delivers it to the user through copy_to_user(). If the N+ROCCAT_CBUF_SIZE th report is received while copying of the Nth report->value is in progress, the pointer that copy_to_user() is working on is kfree()ed and UAF read may occur. (race condition) Since the device node of this driver does not set separate permissions, this is not a security vulnerability, but because it is used for requesting screen display of profile or dpi settings, a user using the roccat device can apply udev to this device node or There is a possibility to use it by giving. Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Ruiqi Gong <gongruiqi1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/hid-roccat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c index 5be8de70c651..c9cec00b4e6e 100644 --- a/drivers/hid/hid-roccat.c +++ b/drivers/hid/hid-roccat.c @@ -260,6 +260,8 @@ int roccat_report_event(int minor, u8 const *data) if (!new_value) return -ENOMEM; + mutex_lock(&device->cbuf_lock); + report = &device->cbuf[device->cbuf_end]; /* passing NULL is safe */ @@ -279,6 +281,8 @@ int roccat_report_event(int minor, u8 const *data) reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE; } + mutex_unlock(&device->cbuf_lock); + wake_up_interruptible(&device->wait); return 0; } -- 2.25.1

1 2

[PATCH openEuler-5.10-LTS 01/16] RDMA/hns: Remove redundant DFX file and DFX ops structure
by Zheng Zengkai 13 Oct '22

13 Oct '22

From: Wenpeng Liang <liangwenpeng(a)huawei.com> mainline inclusion from mainline-for-next commit 40b4b79c866f category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5TAQ5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=40… ---------------------------------------------------------------------- There is no need to use a dedicated DXF file and DFX structure to manage the interface of the query queue context. Link: https://lore.kernel.org/r/20220822104455.2311053-2-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang <liangwenpeng(a)huawei.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Zhengfeng Luo <luozhengfeng(a)h-partners.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> Reviewed-by: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_device.h | 10 ++---- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 ++++++++++++++++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 3 -- drivers/infiniband/hw/hns/hns_roce_main.c | 6 +++- drivers/infiniband/hw/hns/hns_roce_restrack.c | 35 +++++++------------ 6 files changed, 50 insertions(+), 41 deletions(-) diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile index 9f04f25d9631..a7d259238305 100644 --- a/drivers/infiniband/hw/hns/Makefile +++ b/drivers/infiniband/hw/hns/Makefile @@ -10,6 +10,6 @@ hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o ifdef CONFIG_INFINIBAND_HNS_HIP08 -hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs) +hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs) obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o endif diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 2d29221055be..848f0e0e76a4 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -849,11 +849,6 @@ struct hns_roce_caps { enum cong_type cong_type; }; -struct hns_roce_dfx_hw { - int (*query_cqc_info)(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); -}; - enum hns_roce_device_state { HNS_ROCE_DEVICE_STATE_INITED, HNS_ROCE_DEVICE_STATE_RST_DOWN, @@ -899,6 +894,7 @@ struct hns_roce_hw { int (*init_eq)(struct hns_roce_dev *hr_dev); void (*cleanup_eq)(struct hns_roce_dev *hr_dev); int (*write_srqc)(struct hns_roce_srq *srq, void *mb_buf); + int (*query_cqc)(struct hns_roce_dev *hr_dev, u32 cqn, void *buffer); const struct ib_device_ops *hns_roce_dev_ops; const struct ib_device_ops *hns_roce_dev_srq_ops; }; @@ -960,7 +956,6 @@ struct hns_roce_dev { void *priv; struct workqueue_struct *irq_workq; struct work_struct ecc_work; - const struct hns_roce_dfx_hw *dfx; u32 func_num; u32 is_vf; u32 cong_algo_tmpl_id; @@ -1223,8 +1218,7 @@ u8 hns_get_gid_index(struct hns_roce_dev *hr_dev, u8 port, int gid_index); void hns_roce_handle_device_err(struct hns_roce_dev *hr_dev); int hns_roce_init(struct hns_roce_dev *hr_dev); void hns_roce_exit(struct hns_roce_dev *hr_dev); -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq); +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq); struct hns_user_mmap_entry * hns_roce_user_mmap_entry_insert(struct ib_ucontext *ucontext, u64 address, size_t length, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index de7873551ffc..6b772536ab3c 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -5801,6 +5801,35 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period) return ret; } +static int hns_roce_v2_query_cqc(struct hns_roce_dev *hr_dev, u32 cqn, + void *buffer) +{ + struct hns_roce_v2_cq_context *context; + struct hns_roce_cmd_mailbox *mailbox; + int ret; + + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + + context = mailbox->buf; + ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, + HNS_ROCE_CMD_QUERY_CQC, cqn); + if (ret) { + ibdev_err(&hr_dev->ib_dev, + "failed to process cmd when querying CQ, ret = %d.\n", + ret); + goto err_mailbox; + } + + memcpy(buffer, context, sizeof(*context)); + +err_mailbox: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + + return ret; +} + static void hns_roce_irq_work_handle(struct work_struct *work) { struct hns_roce_work *irq_work = @@ -6593,10 +6622,6 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) kfree(eq_table->eq); } -static const struct hns_roce_dfx_hw hns_roce_dfx_hw_v2 = { - .query_cqc_info = hns_roce_v2_query_cqc_info, -}; - static const struct ib_device_ops hns_roce_v2_dev_ops = { .destroy_qp = hns_roce_v2_destroy_qp, .modify_cq = hns_roce_v2_modify_cq, @@ -6637,6 +6662,7 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .init_eq = hns_roce_v2_init_eq_table, .cleanup_eq = hns_roce_v2_cleanup_eq_table, .write_srqc = hns_roce_v2_write_srqc, + .query_cqc = hns_roce_v2_query_cqc, .hns_roce_dev_ops = &hns_roce_v2_dev_ops, .hns_roce_dev_srq_ops = &hns_roce_v2_dev_srq_ops, }; @@ -6668,7 +6694,6 @@ static void hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev, hr_dev->is_vf = id->driver_data; hr_dev->dev = &handle->pdev->dev; hr_dev->hw = &hns_roce_hw_v2; - hr_dev->dfx = &hns_roce_dfx_hw_v2; hr_dev->sdb_offset = ROCEE_DB_SQ_L_0_REG; hr_dev->odb_offset = hr_dev->sdb_offset; diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index 8aa56c24e677..6bf878fe661e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -1455,9 +1455,6 @@ struct hns_roce_sccc_clr_done { __le32 rsv[5]; }; -int hns_roce_v2_query_cqc_info(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); - int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata); int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev, diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 11f42cebfa40..9d4dbc3205c6 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -514,7 +514,6 @@ static const struct ib_device_ops hns_roce_dev_ops = { .destroy_ah = hns_roce_destroy_ah, .destroy_cq = hns_roce_destroy_cq, .disassociate_ucontext = hns_roce_disassociate_ucontext, - .fill_res_cq_entry = hns_roce_fill_res_cq_entry, .get_dma_mr = hns_roce_get_dma_mr, .get_link_layer = hns_roce_get_link_layer, .get_port_immutable = hns_roce_port_immutable, @@ -564,6 +563,10 @@ static const struct ib_device_ops hns_roce_dev_xrcd_ops = { INIT_RDMA_OBJ_SIZE(ib_xrcd, hns_roce_xrcd, ibxrcd), }; +static const struct ib_device_ops hns_roce_dev_restrack_ops = { + .fill_res_cq_entry = hns_roce_fill_res_cq_entry, +}; + static int hns_roce_register_device(struct hns_roce_dev *hr_dev) { int ret; @@ -642,6 +645,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev) ib_set_device_ops(ib_dev, hr_dev->hw->hns_roce_dev_ops); ib_set_device_ops(ib_dev, &hns_roce_dev_ops); + ib_set_device_ops(ib_dev, &hns_roce_dev_restrack_ops); for (i = 0; i < hr_dev->caps.num_ports; i++) { if (!hr_dev->iboe.netdevs[i]) continue; diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c index 24a154d64630..83417be15d3f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_restrack.c +++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c @@ -55,45 +55,34 @@ static int hns_roce_fill_cq(struct sk_buff *msg, return -EMSGSIZE; } -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq) +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq) { struct hns_roce_dev *hr_dev = to_hr_dev(ib_cq->device); struct hns_roce_cq *hr_cq = to_hr_cq(ib_cq); - struct hns_roce_v2_cq_context *context; + struct hns_roce_v2_cq_context context; struct nlattr *table_attr; int ret; - if (!hr_dev->dfx->query_cqc_info) + if (!hr_dev->hw->query_cqc) return -EINVAL; - context = kzalloc(sizeof(struct hns_roce_v2_cq_context), GFP_KERNEL); - if (!context) - return -ENOMEM; - - ret = hr_dev->dfx->query_cqc_info(hr_dev, hr_cq->cqn, (int *)context); + ret = hr_dev->hw->query_cqc(hr_dev, hr_cq->cqn, &context); if (ret) - goto err; + return -EINVAL; table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER); - if (!table_attr) { - ret = -EMSGSIZE; - goto err; - } + if (!table_attr) + return -EMSGSIZE; - if (hns_roce_fill_cq(msg, context)) { - ret = -EMSGSIZE; - goto err_cancel_table; - } + if (hns_roce_fill_cq(msg, &context)) + goto err; nla_nest_end(msg, table_attr); - kfree(context); return 0; -err_cancel_table: - nla_nest_cancel(msg, table_attr); err: - kfree(context); - return ret; + nla_nest_cancel(msg, table_attr); + + return -EMSGSIZE; } -- 2.20.1

1 15

[PATCH openEuler-5.10 01/30] RDMA/hns: Remove redundant DFX file and DFX ops structure
by Zheng Zengkai 11 Oct '22

11 Oct '22

From: Wenpeng Liang <liangwenpeng(a)huawei.com> mainline inclusion from mainline-for-next commit 40b4b79c866f category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5TAQ5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=40… ---------------------------------------------------------------------- There is no need to use a dedicated DXF file and DFX structure to manage the interface of the query queue context. Link: https://lore.kernel.org/r/20220822104455.2311053-2-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang <liangwenpeng(a)huawei.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Zhengfeng Luo <luozhengfeng(a)h-partners.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> Reviewed-by: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_device.h | 10 ++---- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 ++++++++++++++++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 3 -- drivers/infiniband/hw/hns/hns_roce_main.c | 6 +++- drivers/infiniband/hw/hns/hns_roce_restrack.c | 35 +++++++------------ 6 files changed, 50 insertions(+), 41 deletions(-) diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile index 9f04f25d9631..a7d259238305 100644 --- a/drivers/infiniband/hw/hns/Makefile +++ b/drivers/infiniband/hw/hns/Makefile @@ -10,6 +10,6 @@ hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o ifdef CONFIG_INFINIBAND_HNS_HIP08 -hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs) +hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs) obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o endif diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 2d29221055be..848f0e0e76a4 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -849,11 +849,6 @@ struct hns_roce_caps { enum cong_type cong_type; }; -struct hns_roce_dfx_hw { - int (*query_cqc_info)(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); -}; - enum hns_roce_device_state { HNS_ROCE_DEVICE_STATE_INITED, HNS_ROCE_DEVICE_STATE_RST_DOWN, @@ -899,6 +894,7 @@ struct hns_roce_hw { int (*init_eq)(struct hns_roce_dev *hr_dev); void (*cleanup_eq)(struct hns_roce_dev *hr_dev); int (*write_srqc)(struct hns_roce_srq *srq, void *mb_buf); + int (*query_cqc)(struct hns_roce_dev *hr_dev, u32 cqn, void *buffer); const struct ib_device_ops *hns_roce_dev_ops; const struct ib_device_ops *hns_roce_dev_srq_ops; }; @@ -960,7 +956,6 @@ struct hns_roce_dev { void *priv; struct workqueue_struct *irq_workq; struct work_struct ecc_work; - const struct hns_roce_dfx_hw *dfx; u32 func_num; u32 is_vf; u32 cong_algo_tmpl_id; @@ -1223,8 +1218,7 @@ u8 hns_get_gid_index(struct hns_roce_dev *hr_dev, u8 port, int gid_index); void hns_roce_handle_device_err(struct hns_roce_dev *hr_dev); int hns_roce_init(struct hns_roce_dev *hr_dev); void hns_roce_exit(struct hns_roce_dev *hr_dev); -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq); +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq); struct hns_user_mmap_entry * hns_roce_user_mmap_entry_insert(struct ib_ucontext *ucontext, u64 address, size_t length, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index de7873551ffc..6b772536ab3c 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -5801,6 +5801,35 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period) return ret; } +static int hns_roce_v2_query_cqc(struct hns_roce_dev *hr_dev, u32 cqn, + void *buffer) +{ + struct hns_roce_v2_cq_context *context; + struct hns_roce_cmd_mailbox *mailbox; + int ret; + + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + + context = mailbox->buf; + ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, + HNS_ROCE_CMD_QUERY_CQC, cqn); + if (ret) { + ibdev_err(&hr_dev->ib_dev, + "failed to process cmd when querying CQ, ret = %d.\n", + ret); + goto err_mailbox; + } + + memcpy(buffer, context, sizeof(*context)); + +err_mailbox: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + + return ret; +} + static void hns_roce_irq_work_handle(struct work_struct *work) { struct hns_roce_work *irq_work = @@ -6593,10 +6622,6 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) kfree(eq_table->eq); } -static const struct hns_roce_dfx_hw hns_roce_dfx_hw_v2 = { - .query_cqc_info = hns_roce_v2_query_cqc_info, -}; - static const struct ib_device_ops hns_roce_v2_dev_ops = { .destroy_qp = hns_roce_v2_destroy_qp, .modify_cq = hns_roce_v2_modify_cq, @@ -6637,6 +6662,7 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .init_eq = hns_roce_v2_init_eq_table, .cleanup_eq = hns_roce_v2_cleanup_eq_table, .write_srqc = hns_roce_v2_write_srqc, + .query_cqc = hns_roce_v2_query_cqc, .hns_roce_dev_ops = &hns_roce_v2_dev_ops, .hns_roce_dev_srq_ops = &hns_roce_v2_dev_srq_ops, }; @@ -6668,7 +6694,6 @@ static void hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev, hr_dev->is_vf = id->driver_data; hr_dev->dev = &handle->pdev->dev; hr_dev->hw = &hns_roce_hw_v2; - hr_dev->dfx = &hns_roce_dfx_hw_v2; hr_dev->sdb_offset = ROCEE_DB_SQ_L_0_REG; hr_dev->odb_offset = hr_dev->sdb_offset; diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index 8aa56c24e677..6bf878fe661e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -1455,9 +1455,6 @@ struct hns_roce_sccc_clr_done { __le32 rsv[5]; }; -int hns_roce_v2_query_cqc_info(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); - int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata); int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev, diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 11f42cebfa40..9d4dbc3205c6 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -514,7 +514,6 @@ static const struct ib_device_ops hns_roce_dev_ops = { .destroy_ah = hns_roce_destroy_ah, .destroy_cq = hns_roce_destroy_cq, .disassociate_ucontext = hns_roce_disassociate_ucontext, - .fill_res_cq_entry = hns_roce_fill_res_cq_entry, .get_dma_mr = hns_roce_get_dma_mr, .get_link_layer = hns_roce_get_link_layer, .get_port_immutable = hns_roce_port_immutable, @@ -564,6 +563,10 @@ static const struct ib_device_ops hns_roce_dev_xrcd_ops = { INIT_RDMA_OBJ_SIZE(ib_xrcd, hns_roce_xrcd, ibxrcd), }; +static const struct ib_device_ops hns_roce_dev_restrack_ops = { + .fill_res_cq_entry = hns_roce_fill_res_cq_entry, +}; + static int hns_roce_register_device(struct hns_roce_dev *hr_dev) { int ret; @@ -642,6 +645,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev) ib_set_device_ops(ib_dev, hr_dev->hw->hns_roce_dev_ops); ib_set_device_ops(ib_dev, &hns_roce_dev_ops); + ib_set_device_ops(ib_dev, &hns_roce_dev_restrack_ops); for (i = 0; i < hr_dev->caps.num_ports; i++) { if (!hr_dev->iboe.netdevs[i]) continue; diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c index 24a154d64630..83417be15d3f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_restrack.c +++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c @@ -55,45 +55,34 @@ static int hns_roce_fill_cq(struct sk_buff *msg, return -EMSGSIZE; } -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq) +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq) { struct hns_roce_dev *hr_dev = to_hr_dev(ib_cq->device); struct hns_roce_cq *hr_cq = to_hr_cq(ib_cq); - struct hns_roce_v2_cq_context *context; + struct hns_roce_v2_cq_context context; struct nlattr *table_attr; int ret; - if (!hr_dev->dfx->query_cqc_info) + if (!hr_dev->hw->query_cqc) return -EINVAL; - context = kzalloc(sizeof(struct hns_roce_v2_cq_context), GFP_KERNEL); - if (!context) - return -ENOMEM; - - ret = hr_dev->dfx->query_cqc_info(hr_dev, hr_cq->cqn, (int *)context); + ret = hr_dev->hw->query_cqc(hr_dev, hr_cq->cqn, &context); if (ret) - goto err; + return -EINVAL; table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER); - if (!table_attr) { - ret = -EMSGSIZE; - goto err; - } + if (!table_attr) + return -EMSGSIZE; - if (hns_roce_fill_cq(msg, context)) { - ret = -EMSGSIZE; - goto err_cancel_table; - } + if (hns_roce_fill_cq(msg, &context)) + goto err; nla_nest_end(msg, table_attr); - kfree(context); return 0; -err_cancel_table: - nla_nest_cancel(msg, table_attr); err: - kfree(context); - return ret; + nla_nest_cancel(msg, table_attr); + + return -EMSGSIZE; } -- 2.20.1

1 29

[PATCH openEuler-1.0-LTS 1/7] Revert "quota: Add more checking after reading from quota file"
by Yongqiang Liu 11 Oct '22

11 Oct '22

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187046, https://gitee.com/openeuler/kernel/issues/I5QH0X CVE: NA -------------------------------- This reverts commit f66997d9c183c751a27b2b022dff35bded71571a. The mainline of this patch already exists, revert the interim patch. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/quota/quota_tree.c | 43 ++++++++++--------------------------------- 1 file changed, 10 insertions(+), 33 deletions(-) diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c index 3c600ed3781a..5389cabc6f20 100644 --- a/fs/quota/quota_tree.c +++ b/fs/quota/quota_tree.c @@ -79,12 +79,12 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) return ret; } -static inline int do_check_range(struct super_block *sb, const char *val_name, - uint val, uint min_val, uint max_val) +static inline int do_check_range(struct super_block *sb, uint val, + uint min_val, uint max_val) { if (val < min_val || val >= max_val) { - quota_error(sb, "Getting %s %u out of range %u-%u", - val_name, val, min_val, max_val); + quota_error(sb, "Getting block %u out of range %u-%u", + val, min_val, max_val); return -EUCLEAN; } @@ -98,13 +98,11 @@ static int check_free_block(struct qtree_mem_dqinfo *info, uint nextblk, prevblk; nextblk = le32_to_cpu(dh->dqdh_next_free); - err = do_check_range(info->dqi_sb, "dqdh_next_free", nextblk, 0, - info->dqi_blocks); + err = do_check_range(info->dqi_sb, nextblk, 0, info->dqi_blocks); if (err) return err; prevblk = le32_to_cpu(dh->dqdh_prev_free); - err = do_check_range(info->dqi_sb, "dqdh_prev_free", prevblk, 0, - info->dqi_blocks); + err = do_check_range(info->dqi_sb, prevblk, 0, info->dqi_blocks); if (err) return err; @@ -278,11 +276,6 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info, *err = check_free_block(info, dh); if (*err) goto out_buf; - *err = do_check_range(info->dqi_sb, "dqdh_entries", - le16_to_cpu(dh->dqdh_entries), 0, - qtree_dqstr_in_blk(info)); - if (*err) - goto out_buf; } else { blk = get_free_dqblk(info); if ((int)blk < 0) { @@ -364,10 +357,6 @@ static int do_insert_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, } ref = (__le32 *)buf; newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); - ret = do_check_range(dquot->dq_sb, "block", newblk, 0, - info->dqi_blocks); - if (ret) - goto out_buf; if (!newblk) newson = 1; if (depth == info->dqi_qtree_depth - 1) { @@ -480,11 +469,6 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot, } dh = (struct qt_disk_dqdbheader *)buf; ret = check_free_block(info, dh); - if (ret) - goto out_buf; - ret = do_check_range(info->dqi_sb, "dqdh_entries", - le16_to_cpu(dh->dqdh_entries), 1, - qtree_dqstr_in_blk(info) + 1); if (ret) goto out_buf; le16_add_cpu(&dh->dqdh_entries, -1); @@ -543,7 +527,7 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, goto out_buf; } newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); - ret = do_check_range(dquot->dq_sb, "block", newblk, QT_TREEOFF, + ret = do_check_range(dquot->dq_sb, newblk, QT_TREEOFF, info->dqi_blocks); if (ret) goto out_buf; @@ -647,8 +631,7 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info, blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); if (!blk) /* No reference? */ goto out_buf; - ret = do_check_range(dquot->dq_sb, "block", blk, QT_TREEOFF, - info->dqi_blocks); + ret = do_check_range(dquot->dq_sb, blk, QT_TREEOFF, info->dqi_blocks); if (ret) goto out_buf; @@ -764,13 +747,7 @@ static int find_next_id(struct qtree_mem_dqinfo *info, qid_t *id, goto out_buf; } for (i = __get_index(info, *id, depth); i < epb; i++) { - uint blk_no = le32_to_cpu(ref[i]); - - ret = do_check_range(info->dqi_sb, "block", blk_no, 0, - info->dqi_blocks); - if (ret) - goto out_buf; - if (blk_no == 0) { + if (ref[i] == cpu_to_le32(0)) { *id += level_inc; continue; } @@ -778,7 +755,7 @@ static int find_next_id(struct qtree_mem_dqinfo *info, qid_t *id, ret = 0; goto out_buf; } - ret = find_next_id(info, id, blk_no, depth + 1); + ret = find_next_id(info, id, le32_to_cpu(ref[i]), depth + 1); if (ret != -ENOENT) break; } -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 00/30] linux-4.19-y inclusion
by Yongqiang Liu 11 Oct '22

11 Oct '22

Brian Norris (1): tracefs: Only clobber mode/uid/gid on remount if asked David Hildenbrand (1): mm/hugetlb: fix hugetlb not supporting softdirty tracking Denis V. Lunev (1): neigh: fix possible DoS due to net iface start/stop loop Eric Dumazet (1): tcp: annotate data-race around challenge_timestamp Florian Westphal (2): netfilter: ebtables: reject blobs that don't provide all entry points netfilter: ebtables: fix memory leak when blob is malformed Gaosheng Cui (1): audit: fix potential double free on error path from fsnotify_add_inode_mark Greg Kroah-Hartman (1): debugfs: add debugfs_lookup_and_remove() Harsh Modi (1): netfilter: br_netfilter: Drop dst references before setting. Jann Horn (1): mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() Jonathan Toppins (1): bonding: 802.3ad: fix no transmission of LACPDUs Kuniyuki Iwashima (9): net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. net: Fix a data-race around netdev_budget_usecs. net: Fix a data-race around sysctl_somaxconn. Maciej Żenczykowski (1): net: ipvtap - add __init/__exit annotations to module init/exit funcs Mike Snitzer (1): dm: return early from dm_pr_call() if DM device is suspended Neal Cardwell (1): tcp: fix early ETIMEDOUT after spurious non-SACK RTO NeilBrown (1): SUNRPC: use _bh spinlocking on ->transport_lock Quanyang Wang (1): asm-generic: sections: refactor memory_intersects Siddh Raman Pant (1): loop: Check for overflow while configuring loop Trond Myklebust (1): NFSv4: Fix races in the legacy idmapper upcall Xin Xiong (1): xfrm: fix refcount leak in __xfrm_policy_check() Yang Yingliang (1): net: neigh: don't call kfree_skb() under spin_lock_irqsave() Yee Lee (1): Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" drivers/block/loop.c | 5 +++ drivers/md/dm.c | 5 +++ drivers/net/bonding/bond_3ad.c | 38 ++++++++----------- drivers/net/ipvlan/ipvtap.c | 4 +- fs/debugfs/inode.c | 22 +++++++++++ fs/nfs/nfs4idmap.c | 46 ++++++++++++----------- fs/tracefs/inode.c | 29 ++++++++++---- include/asm-generic/sections.h | 7 +++- include/linux/debugfs.h | 6 +++ include/linux/netfilter_bridge/ebtables.h | 4 -- include/net/busy_poll.h | 2 +- kernel/audit_fsnotify.c | 1 + lib/ratelimit.c | 12 ++++-- mm/kmemleak.c | 8 ++-- mm/mmap.c | 17 +++++++-- net/bridge/br_netfilter_hooks.c | 2 + net/bridge/br_netfilter_ipv6.c | 1 + net/bridge/netfilter/ebtable_broute.c | 8 ---- net/bridge/netfilter/ebtable_filter.c | 8 ---- net/bridge/netfilter/ebtable_nat.c | 8 ---- net/bridge/netfilter/ebtables.c | 10 ++--- net/core/dev.c | 14 +++---- net/core/neighbour.c | 27 ++++++++++--- net/core/skbuff.c | 2 +- net/core/sock.c | 2 +- net/core/sysctl_net_core.c | 15 +++++--- net/ipv4/tcp_input.c | 29 +++++++++----- net/sched/sch_generic.c | 2 +- net/socket.c | 2 +- net/sunrpc/xprt.c | 4 +- net/xfrm/xfrm_policy.c | 1 + 31 files changed, 205 insertions(+), 136 deletions(-) -- 2.25.1

1 30

[PATCH openEuler-1.0-LTS] bonding: fix reference count leak in balance-alb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 4f5d33f4f798b1c6d92b613f0087f639d9836971 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ------------------------------------------------------------------------ Commit d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") introduced a reference count leak by not releasing the reference acquired by ip_dev_find(). Remedy this by insuring the reference is released. Fixes: d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") Signed-off-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://lore.kernel.org/r/26758.1660194413@famine Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index f493bcf..87ad03c 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -680,8 +680,11 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); if (dev) { - if (netif_is_bridge_master(dev)) + if (netif_is_bridge_master(dev)) { + dev_put(dev); return NULL; + } + dev_put(dev); } if (arp->op_code == htons(ARPOP_REPLY)) { -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS] net:bonding:support balance-alb interface with vlan to bridge
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit d5410ac7b0baeca91cf73ff5241d35998ecc8c9e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ----------------------------------------------------------------- In my test, balance-alb bonding with two slaves eth0 and eth1, and then Bond0.150 is created with vlan id attached bond0. After adding bond0.150 into one linux bridge, I noted that Bond0, bond0.150 and bridge were assigned to the same MAC as eth0. Once bond0.150 receives a packet whose dest IP is bridge's and dest MAC is eth1's, the linux bridge will not match eth1's MAC entry in FDB, and not handle it as expected. The patch fix the issue, and diagram as below: eth1(mac:eth1_mac)--bond0(balance-alb,mac:eth0_mac)--eth0(mac:eth0_mac) | bond0.150(mac:eth0_mac) | bridge(ip:br_ip, mac:eth0_mac)--other port Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 856efe8..f493bcf 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -665,6 +665,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) { struct slave *tx_slave = NULL; + struct net_device *dev; struct arp_pkt *arp; if (!pskb_network_may_pull(skb, sizeof(*arp))) @@ -677,6 +678,12 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) if (!bond_slave_has_mac_rx(bond, arp->mac_src)) return NULL; + dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); + if (dev) { + if (netif_is_bridge_master(dev)) + return NULL; + } + if (arp->op_code == htons(ARPOP_REPLY)) { /* the arp must be sent on the selected rx channel */ tx_slave = rlb_choose_channel(skb, bond, arp); -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UY5E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/dri… ------------------------------------------------------------ Since ipv6 neighbor solicitation and advertisement messages isn't handled gracefully in bond6 driver, we can see packet drop due to inconsistency between mac address in the option message and source MAC . Another examples is ipv6 neighbor solicitation and advertisement messages from VM via tap attached to host bridge, the src mac might be changed through balance-alb mode, but it is not synced with Link-layer address in the option message. The patch implements bond6's tx handle for ipv6 neighbor solicitation and advertisement messages. Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Acked-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index a6a89a0..856efe8 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -1281,6 +1281,27 @@ static int alb_set_mac_address(struct bonding *bond, void *addr) return res; } +/* determine if the packet is NA or NS */ +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond) +{ + struct ipv6hdr *ip6hdr; + struct icmp6hdr *hdr; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) + return true; + + ip6hdr = ipv6_hdr(skb); + if (ip6hdr->nexthdr != IPPROTO_ICMPV6) + return false; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr))) + return true; + + hdr = icmp6_hdr(skb); + return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT || + hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION; +} + /************************ exported alb funcions ************************/ int bond_alb_initialize(struct bonding *bond, int rlb_enabled) @@ -1363,10 +1384,12 @@ netdev_tx_t bond_tlb_xmit(struct sk_buff *skb, struct net_device *bond_dev) /* Do not TX balance any multicast or broadcast */ if (!is_multicast_ether_addr(eth_data->h_dest)) { switch (skb->protocol) { + case htons(ETH_P_IPV6): + if (alb_determine_nd(skb, bond)) + break; case htons(ETH_P_IP): case htons(ETH_P_IPX): /* In case of IPX, it will falback to L2 hash */ - case htons(ETH_P_IPV6): hash_index = bond_xmit_hash(bond, skb); if (bond->params.tlb_dynamic_lb) { tx_slave = tlb_choose_channel(bond, @@ -1440,10 +1463,12 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev) break; } - if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) { + if (alb_determine_nd(skb, bond)) { do_tx_balance = false; break; } + + /* The IPv6 header is pulled by alb_determine_nd */ /* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. -- 1.8.3.1

1 0

[PATCH OLK-5.10] bonding: fix reference count leak in balance-alb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 4f5d33f4f798b1c6d92b613f0087f639d9836971 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ------------------------------------------------------------------------------------ Commit d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") introduced a reference count leak by not releasing the reference acquired by ip_dev_find(). Remedy this by insuring the reference is released. Fixes: d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") Signed-off-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://lore.kernel.org/r/26758.1660194413@famine Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index d9c03a9..9130b57 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -665,8 +665,11 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); if (dev) { - if (netif_is_bridge_master(dev)) + if (netif_is_bridge_master(dev)) { + dev_put(dev); return NULL; + } + dev_put(dev); } if (arp->op_code == htons(ARPOP_REPLY)) { -- 1.8.3.1

1 0

[PATCH OLK-5.10] net:bonding:support balance-alb interface with vlan to bridge
by Sun Shouxin 10 Oct '22

10 Oct '22

mainline inclusion from mainline-v6.0 commit d5410ac7b0baeca91cf73ff5241d35998ecc8c9e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… --------------------------------------------------------------- In my test, balance-alb bonding with two slaves eth0 and eth1, and then Bond0.150 is created with vlan id attached bond0. After adding bond0.150 into one linux bridge, I noted that Bond0, bond0.150 and bridge were assigned to the same MAC as eth0. Once bond0.150 receives a packet whose dest IP is bridge's and dest MAC is eth1's, the linux bridge will not match eth1's MAC entry in FDB, and not handle it as expected. The patch fix the issue, and diagram as below: eth1(mac:eth1_mac)--bond0(balance-alb,mac:eth0_mac)--eth0(mac:eth0_mac) | bond0.150(mac:eth0_mac) | bridge(ip:br_ip, mac:eth0_mac)--other port Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 8826380..d9c03a9 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -650,6 +650,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) { struct slave *tx_slave = NULL; + struct net_device *dev; struct arp_pkt *arp; if (!pskb_network_may_pull(skb, sizeof(*arp))) @@ -662,6 +663,12 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) if (!bond_slave_has_mac_rx(bond, arp->mac_src)) return NULL; + dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); + if (dev) { + if (netif_is_bridge_master(dev)) + return NULL; + } + if (arp->op_code == htons(ARPOP_REPLY)) { /* the arp must be sent on the selected rx channel */ tx_slave = rlb_choose_channel(skb, bond, arp); -- 1.8.3.1

1 0

[PATCH OLK-5.10] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
by Sun Shouxin 10 Oct '22

10 Oct '22

mainline inclusion from mainline-v6.0 commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UY5E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/dri… ----------------------------------------------------------- Since ipv6 neighbor solicitation and advertisement messages isn't handled gracefully in bond6 driver, we can see packet drop due to inconsistency between mac address in the option message and source MAC . Another examples is ipv6 neighbor solicitation and advertisement messages from VM via tap attached to host bridge, the src mac might be changed through balance-alb mode, but it is not synced with Link-layer address in the option message. The patch implements bond6's tx handle for ipv6 neighbor solicitation and advertisement messages. Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Acked-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 0436aef9c9ef..882638076355 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -1268,6 +1268,27 @@ static int alb_set_mac_address(struct bonding *bond, void *addr) return res; } +/* determine if the packet is NA or NS */ +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond) +{ + struct ipv6hdr *ip6hdr; + struct icmp6hdr *hdr; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) + return true; + + ip6hdr = ipv6_hdr(skb); + if (ip6hdr->nexthdr != IPPROTO_ICMPV6) + return false; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr))) + return true; + + hdr = icmp6_hdr(skb); + return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT || + hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION; +} + /************************ exported alb funcions ************************/ int bond_alb_initialize(struct bonding *bond, int rlb_enabled) @@ -1347,10 +1368,13 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *bond, /* Do not TX balance any multicast or broadcast */ if (!is_multicast_ether_addr(eth_data->h_dest)) { switch (skb->protocol) { + case htons(ETH_P_IPV6): + if (alb_determine_nd(skb, bond)) + break; + fallthrough; case htons(ETH_P_IP): case htons(ETH_P_IPX): /* In case of IPX, it will falback to L2 hash */ - case htons(ETH_P_IPV6): hash_index = bond_xmit_hash(bond, skb); if (bond->params.tlb_dynamic_lb) { tx_slave = tlb_choose_channel(bond, @@ -1433,10 +1457,12 @@ struct slave *bond_xmit_alb_slave_get(struct bonding *bond, break; } - if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) { + if (alb_determine_nd(skb, bond)) { do_tx_balance = false; break; } + + /* The IPv6 header is pulled by alb_determine_nd */ /* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS 1/3] ext4: check if directory block is within i_size
by Yongqiang Liu 10 Oct '22

10 Oct '22

From: Lukas Czerner <lczerner(a)redhat.com> mainline inclusion from mainline-v6.0-rc1 commit 65f8ea4cd57dbd46ea13b41dc8bac03176b04233 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I58WSQ CVE: CVE-2022-1184 -------------------------------- Currently ext4 directory handling code implicitly assumes that the directory blocks are always within the i_size. In fact ext4_append() will attempt to allocate next directory block based solely on i_size and the i_size is then appropriately increased after a successful allocation. However, for this to work it requires i_size to be correct. If, for any reason, the directory inode i_size is corrupted in a way that the directory tree refers to a valid directory block past i_size, we could end up corrupting parts of the directory tree structure by overwriting already used directory blocks when modifying the directory. Fix it by catching the corruption early in __ext4_read_dirblock(). Addresses Red-Hat-Bugzilla: #2070205 CVE: CVE-2022-1184 Signed-off-by: Lukas Czerner <lczerner(a)redhat.com> Cc: stable(a)vger.kernel.org Reviewed-by: Andreas Dilger <adilger(a)dilger.ca> Link: https://lore.kernel.org/r/20220704142721.157985-1-lczerner@redhat.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/namei.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/namei.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index b2d4fb82e8f4..1a9eda144c7a 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -124,6 +124,13 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, struct ext4_dir_entry *dirent; int is_dx_block = 0; + if (block >= inode->i_size) { + ext4_error_inode(inode, func, line, block, + "Attempting to read directory block (%u) that is past i_size (%llu)", + block, inode->i_size); + return ERR_PTR(-EFSCORRUPTED); + } + bh = ext4_bread(NULL, inode, block, 0); if (IS_ERR(bh)) { __ext4_warning(inode->i_sb, func, line, -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 01/10] md/raid10: prevent unnecessary calls to wake_up() in fast path
by Yongqiang Liu 09 Oct '22

09 Oct '22

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from md-next commit 7fdc91928ac109d3d1468ad7f951deb29a375e3d category: performance bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PRMO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/song/md.git/commit/?h=md-ne… -------------------------------- Currently, wake_up() is called unconditionally in fast path such as raid10_make_request(), which will cause lock contention under high concurrency: raid10_make_request wake_up __wake_up_common_lock spin_lock_irqsave Improve performance by only call wake_up() if waitqueue is not empty. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Signed-off-by: Song Liu <song(a)kernel.org> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/raid10.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 5049c4d829e5..13e0b4a462fc 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -305,6 +305,12 @@ static void put_buf(struct r10bio *r10_bio) lower_barrier(conf); } +static void wake_up_barrier(struct r10conf *conf) +{ + if (wq_has_sleeper(&conf->wait_barrier)) + wake_up(&conf->wait_barrier); +} + static void reschedule_retry(struct r10bio *r10_bio) { unsigned long flags; @@ -1025,7 +1031,7 @@ static void allow_barrier(struct r10conf *conf) { if ((atomic_dec_and_test(&conf->nr_pending)) || (conf->array_freeze_pending)) - wake_up(&conf->wait_barrier); + wake_up_barrier(conf); } static void freeze_array(struct r10conf *conf, int extra) @@ -1584,7 +1590,7 @@ static bool raid10_make_request(struct mddev *mddev, struct bio *bio) __make_request(mddev, bio, sectors); /* In case raid10d snuck in to freeze_array */ - wake_up(&conf->wait_barrier); + wake_up_barrier(conf); return true; } -- 2.25.1

1 9

申报一个议题：Add sysfs file for OverlayFS
by hiixfj 02 Oct '22

02 Oct '22

您好：在实际生产环境中不断出现overlayfs没有真正卸掉的出现了诸如quota统计数据持续增长等问题。对于现网环境目前没有好的办法去界定该类情况。 overlayfs在实际使用过程中是有很多限制但是并没有在代码层面直接做限制，所以在使用过程会出现操作错误引入的一些奇怪的问题往往这类问题表露出来的现象是比较奇怪的，定位起来比较耗时。基于这样的背景overlayfs的维测功能需要增强。该补丁为 overlayfs 增加了 sysfs 文件，用于记录 overlayfs 的挂载信息。 PR链接：https://gitee.com/openeuler/kernel/pulls/149 ------------------------------------------- 手机：(+86) 151-1048-1699 邮箱：hiixfj(a)gmail.com

1 0