March 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 1/6] ext4: convert DIV_ROUND_UP to DIV_ROUND_UP_ULL
by Zheng Zengkai 02 Mar '22

02 Mar '22

From: Zhang Yi <yi.zhang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4VAQC?from=project-issue CVE: NA -------------------------------- Fix a compile error on arm32 architecture. build failed: arm, allmodconfig ERROR: modpost: "__aeabi_ldivmod" [fs/ext4/ext4.ko] undefined! make[1]: *** [modules-only.symvers] Error 1 make[1]: *** Deleting file 'modules-only.symvers' make: *** [modules] Error 2 Fixes: 356efe60eb78 ("ext4: fix underflow in ext4_max_bitmap_size()") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/ext4/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 19539be45aec..f1a089ebe848 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -3274,15 +3274,15 @@ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files) upper_limit -= ppb; /* double indirect blocks */ if (upper_limit < ppb * ppb) { - meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb); + meta_blocks += 1 + DIV_ROUND_UP_ULL(upper_limit, ppb); res -= meta_blocks; goto check_lfs; } meta_blocks += 1 + ppb; upper_limit -= ppb * ppb; /* tripple indirect blocks for the rest */ - meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb) + - DIV_ROUND_UP(upper_limit, ppb*ppb); + meta_blocks += 1 + DIV_ROUND_UP_ULL(upper_limit, ppb) + + DIV_ROUND_UP_ULL(upper_limit, ppb*ppb); res -= meta_blocks; check_lfs: res <<= bits; -- 2.20.1

1 5

[PATCH openEuler-1.0-LTS] f2fs: fix to do sanity check on inode type during garbage collection
by Yang Yingliang 02 Mar '22

02 Mar '22

From: Chao Yu <chao(a)kernel.org> mainline inclusion from mainline-v5.16-rc1 commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f category: bugfix bugzilla: 186264 CVE: CVE-2021-44879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As report by Wenqing Liu in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215231 - Overview kernel NULL pointer dereference triggered in folio_mark_dirty() when mount and operate on a crafted f2fs image - Reproduce tested on kernel 5.16-rc3, 5.15.X under root 1. mkdir mnt 2. mount -t f2fs tmp1.img mnt 3. touch tmp 4. cp tmp mnt F2FS-fs (loop0): sanity_check_inode: inode (ino=49) extent info [5942, 4294180864, 4] is incorrect, run fsck to fix F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=31340049, run fsck to fix. BUG: kernel NULL pointer dereference, address: 0000000000000000 folio_mark_dirty+0x33/0x50 move_data_page+0x2dd/0x460 [f2fs] do_garbage_collect+0xc18/0x16a0 [f2fs] f2fs_gc+0x1d3/0xd90 [f2fs] f2fs_balance_fs+0x13a/0x570 [f2fs] f2fs_create+0x285/0x840 [f2fs] path_openat+0xe6d/0x1040 do_filp_open+0xc5/0x140 do_sys_openat2+0x23a/0x310 do_sys_open+0x57/0x80 The root cause is for special file: e.g. character, block, fifo or socket file, f2fs doesn't assign address space operations pointer array for mapping->a_ops field, so, in a fuzzed image, SSA table indicates a data block belong to special file, when f2fs tries to migrate that block, it causes NULL pointer access once move_data_page() calls a_ops->set_dirty_page(). Cc: stable(a)vger.kernel.org Reported-by: Wenqing Liu <wenqingliu0120(a)gmail.com> Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Guo Xuenan <guoxuenan(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: fang wei <fangwei1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/f2fs/gc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c index 700c39ec99f5a..f4f7b8feebefc 100644 --- a/fs/f2fs/gc.c +++ b/fs/f2fs/gc.c @@ -953,7 +953,8 @@ static void gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, if (phase == 3) { inode = f2fs_iget(sb, dni.ino); - if (IS_ERR(inode) || is_bad_inode(inode)) + if (IS_ERR(inode) || is_bad_inode(inode) || + special_file(inode->i_mode)) continue; if (!down_write_trylock( -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/18] mm: Ratelimited mirrored memory related warning messages
by Yang Yingliang 01 Mar '22

01 Mar '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- If system has mirrored memory, memblock will try to allocate mirrored memory firstly and fallback to non-mirrored memory when fails, but if with limited mirrored memory or some numa node without mirrored memory, lots of warning message about memblock allocation will occur. This patch ratelimit the warning message to avoid a very long print during bootup. Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Kefeng Wang<wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/memblock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/memblock.c b/mm/memblock.c index 13be610a381f4..80c6975ace6f2 100644 --- a/mm/memblock.c +++ b/mm/memblock.c @@ -291,7 +291,7 @@ phys_addr_t __init_memblock memblock_find_in_range(phys_addr_t start, NUMA_NO_NODE, flags); if (!ret && (flags & MEMBLOCK_MIRROR)) { - pr_warn("Could not allocate %pap bytes of mirrored memory\n", + pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", &size); flags &= ~MEMBLOCK_MIRROR; goto again; @@ -1425,7 +1425,7 @@ static void * __init memblock_virt_alloc_internal( if (flags & MEMBLOCK_MIRROR) { flags &= ~MEMBLOCK_MIRROR; - pr_warn("Could not allocate %pap bytes of mirrored memory\n", + pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", &size); goto again; } -- 2.25.1

1 17

[PATCH OLK-5.10] configs: update the defconfigs to support 9P
by Chao Liu 01 Mar '22

01 Mar '22

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4VPL5 CVE: NA ------------------------------------------------- Enable configs to support 9P. Signed-off-by: Chao Liu <liuchao173(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 8ded00ca3364..d19da343bf1e 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1876,7 +1876,10 @@ CONFIG_RFKILL=m CONFIG_RFKILL_LEDS=y CONFIG_RFKILL_INPUT=y CONFIG_RFKILL_GPIO=m -# CONFIG_NET_9P is not set +CONFIG_NET_9P=m +CONFIG_NET_9P_VIRTIO=m +# CONFIG_NET_9P_RDMA is not set +# CONFIG_NET_9P_DEBUG is not set # CONFIG_CAIF is not set CONFIG_CEPH_LIB=m # CONFIG_CEPH_LIB_PRETTYDEBUG is not set @@ -6397,6 +6400,10 @@ CONFIG_CIFS_DFS_UPCALL=y # CONFIG_CIFS_FSCACHE is not set # CONFIG_CODA_FS is not set # CONFIG_AFS_FS is not set +CONFIG_9P_FS=m +CONFIG_9P_FSCACHE=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_9P_FS_SECURITY=y CONFIG_EULER_FS=m CONFIG_NLS=y CONFIG_NLS_DEFAULT="utf8" -- 2.23.0

2 1

[PATCH OLK-5.10] configs: disable CONFIG_RODATA_FULL_DEFAULT_ENABLED
by Chao Liu 01 Mar '22

01 Mar '22

If this config is enabled, block mapping is not used. The linear address page table is mapped to 4 KB. As a result, the TLB miss rate is high, affecting performance. This additional enhancement can be turned on with rodata=full if this option is set to 'n'. Signed-off-by: Chao Liu <liuchao173(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index b476b105ee10..8ded00ca3364 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -433,7 +433,7 @@ CONFIG_ARM64_CPU_PARK=y # CONFIG_XEN is not set CONFIG_FORCE_MAX_ZONEORDER=11 CONFIG_UNMAP_KERNEL_AT_EL0=y -CONFIG_RODATA_FULL_DEFAULT_ENABLED=y +# CONFIG_RODATA_FULL_DEFAULT_ENABLED is not set CONFIG_ARM64_PMEM_RESERVE=y CONFIG_ARM64_PMEM_LEGACY=m # CONFIG_ARM64_SW_TTBR0_PAN is not set -- 2.23.0

2 1

[PATCH OLK-5.10] configs: disable CONFIG_RODATA_FULL_DEFAULT_ENABLED
by Chao Liu 01 Mar '22

01 Mar '22

euler inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4VPIB CVE: NA ------------------------------------------------- If this config is enabled, block mapping is not used. The linear address page table is mapped to 4 KB. As a result, the TLB miss rate is high, affecting performance. This additional enhancement can be turned on with rodata=full if this option is set to 'n'. Signed-off-by: Chao Liu <liuchao173(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index b476b105ee10..8ded00ca3364 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -433,7 +433,7 @@ CONFIG_ARM64_CPU_PARK=y # CONFIG_XEN is not set CONFIG_FORCE_MAX_ZONEORDER=11 CONFIG_UNMAP_KERNEL_AT_EL0=y -CONFIG_RODATA_FULL_DEFAULT_ENABLED=y +# CONFIG_RODATA_FULL_DEFAULT_ENABLED is not set CONFIG_ARM64_PMEM_RESERVE=y CONFIG_ARM64_PMEM_LEGACY=m # CONFIG_ARM64_SW_TTBR0_PAN is not set -- 2.23.0

1 0

[PATCH openEuler-1.0-LTS 1/2] USB: gadget: validate interface OS descriptor requests
by Yang Yingliang 01 Mar '22

01 Mar '22

From: Szymon Heidrich <szymon.heidrich(a)gmail.com> stable inclusion from linux-4.19.230 commit e5eb8d19aee115d8fb354d1eff1b8df700467164 CVE: CVE-2022-25258 -------------------------------- commit 75e5b4849b81e19e9efe1654b30d7f3151c33c2c upstream. Stall the control endpoint in case provided index exceeds array size of MAX_CONFIG_INTERFACES or when the retrieved function pointer is null. Signed-off-by: Szymon Heidrich <szymon.heidrich(a)gmail.com> Cc: stable(a)kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/usb/gadget/composite.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index d39ebf5bdbdd5..0f2af1e1e8f4b 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1865,6 +1865,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) if (w_index != 0x5 || (w_value >> 8)) break; interface = w_value & 0xFF; + if (interface >= MAX_CONFIG_INTERFACES || + !os_desc_cfg->interface[interface]) + break; buf[6] = w_index; count = count_ext_prop(os_desc_cfg, interface); -- 2.25.1

1 1