September 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] selftests/bpf: Enlarge select() timeout for test_maps
by tangbin 13 Sep '22

13 Sep '22

From: Li Zhijian <lizhijian(a)cn.fujitsu.com> stable inclusion from stable-v4.19.207 commit 4c48bd3aa1a33cb3e8a0eca8330b8f100f43d895 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QR5E CVE: NA -------------------------------- commit 2d82d73da35b72b53fe0d96350a2b8d929d07e42 0Day robot observed that it's easily timeout on a heavy load host. ------------------- # selftests: bpf: test_maps # Fork 1024 tasks to 'test_update_delete' # Fork 1024 tasks to 'test_update_delete' # Fork 100 tasks to 'test_hashmap' # Fork 100 tasks to 'test_hashmap_percpu' # Fork 100 tasks to 'test_hashmap_sizes' # Fork 100 tasks to 'test_hashmap_walk' # Fork 100 tasks to 'test_arraymap' # Fork 100 tasks to 'test_arraymap_percpu' # Failed sockmap unexpected timeout not ok 3 selftests: bpf: test_maps # exit=1 # selftests: bpf: test_lru_map # nr_cpus:8 ------------------- Since this test will be scheduled by 0Day to a random host that could have only a few cpus(2-8), enlarge the timeout to avoid a false NG report. In practice, i tried to pin it to only one cpu by 'taskset 0x01 ./test_maps', and knew 10S is likely enough, but i still perfer to a larger value 30. Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Li Zhijian <lizhijian(a)cn.fujitsu.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Song Liu <songliubraving(a)fb.com> Link: https://lore.kernel.org/bpf/20210820015556.23276-2-lizhijian@cn.fujitsu.com Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- tools/testing/selftests/bpf/test_maps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c index 9b552c0fc47d..e5e62cb57ff7 100644 --- a/tools/testing/selftests/bpf/test_maps.c +++ b/tools/testing/selftests/bpf/test_maps.c @@ -796,7 +796,7 @@ static void test_sockmap(int tasks, void *data) FD_ZERO(&w); FD_SET(sfd[3], &w); - to.tv_sec = 1; + to.tv_sec = 30; to.tv_usec = 0; s = select(sfd[3] + 1, &w, NULL, NULL, &to); if (s == -1) { -- 2.18.4

1 0

[PATCH openEuler-5.10 1/3] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Zheng Zengkai 13 Sep '22

13 Sep '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> stable inclusion from stable-v5.10.137 commit 1a4b18b1ff11ba26f9a852019d674fde9d1d1cff category: bugfix bugzilla: 187457, https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 upstream. When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 560a93aad5b6..7b0497da2d94 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3638,6 +3638,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3648,6 +3649,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3668,7 +3670,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.20.1

1 2

[PATCH openEuler-22.09] Add openEuler header script for LoongArch
by Zheng Zengkai 13 Sep '22

13 Sep '22

Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- add-openeuler-head_loongarch.py | 39 +++++++++++++++++++ modify_message_loongarch.py | 62 ++++++++++++++++++++++++++++++ usage | 68 +++++++++++++++++++++++++++++++++ 3 files changed, 169 insertions(+) create mode 100755 add-openeuler-head_loongarch.py create mode 100755 modify_message_loongarch.py create mode 100644 usage diff --git a/add-openeuler-head_loongarch.py b/add-openeuler-head_loongarch.py new file mode 100755 index 000000000000..8219f6b6d8d2 --- /dev/null +++ b/add-openeuler-head_loongarch.py @@ -0,0 +1,39 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import textwrap + +dir = os.path.split(os.path.realpath(__file__))[0] + +def parser_arg(): + parser = argparse.ArgumentParser( + formatter_class=argparse.RawDescriptionHelpFormatter, + description=textwrap.dedent('''\ + Use git rebase to add header for commits on current branch + Note: + Make sure modify_message_loonarch.py be in the same dir + ''')) + + parser.add_argument('-n', type=str, default="", help='add head to last n patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +def main(): + args = parser_arg() + + if args.n == "": + args.n = os.popen("git log --oneline origin/openEuler-22.09..HEAD | wc -l").readline().strip("\n") + + command ="git rebase --onto HEAD~" + args.n + " HEAD~" + args.n + " --exec \"" + command += dir + "/modify_message_loongarch.py " + command += " --bugzilla " + args.bugzilla + " " + command += "\"" + print(command) + os.system(command) + +if __name__ == "__main__": + # execute only if run as a script + main() + diff --git a/modify_message_loongarch.py b/modify_message_loongarch.py new file mode 100755 index 000000000000..6853178794f7 --- /dev/null +++ b/modify_message_loongarch.py @@ -0,0 +1,62 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import re + +def parser_arg(): + parser = argparse.ArgumentParser(description='add head to last patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +args = parser_arg() + +def add_head_loongarch(title): + head = [ + "LoongArch inclusion\n", + "category: feature\n", + "bugzilla: " + args.bugzilla + "\n", + "\n", + "--------------------------------\n", + "\n", + ] + return head + +def add_head(): + MSG = ".git/TEMP_COMMIT_MSG" + message = os.popen("git log -n 1 --pretty=%B").readlines() + find = 0 + + title = message[0].strip("\n"); + + # there is areadly a head + if title[0] == "[": + return + + if find == 0: + head = add_head_loongarch(title) + if head: + find = 1 + + if message[1] == "\t\n": + post = 1; + else: + post = 2; + + message[post:post] = head + + f = open(MSG, 'w') + for line in message: + f.write(line) + f.close() + + os.system("git commit --amend -F " + MSG) + +def main(): + add_head() + return 0 + +if __name__ == "__main__": + # execute only if run as a script + main() diff --git a/usage b/usage new file mode 100644 index 000000000000..97c9bd7e05da --- /dev/null +++ b/usage @@ -0,0 +1,68 @@ +Usage: +./add-openeuler-head_loongarch.py -n=2 --bugzilla=https://gitee.com/openeuler/kernel/issues/I5OHOB + +-n to specify the number of patches to add header to. + +before adding header: + +commit f0f6daca3f4677e3aa2817e204e2281d0d999614 +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 6c3213c6068534e84e65cf1f2aff0ed18810cc4b +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +After adding header: + +commit 94e56df31f6c6b8177687b7f7db6362d62183cd5 (HEAD -> openEuler-22.09) +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 7e7e79233dce5cef575c35ab40b67982919eb1ca +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> -- 2.20.1

1 0

[PATCH openEuler-22.09 0/6] tools/bpftool: Add BTF_KIND_FLOAT support
by Zheng Zengkai 08 Sep '22

08 Sep '22

Some BPF programs compiled on s390 fail to load, because s390 arch-specific linux headers contain float and double types. Introduce support for such types by representing them using the new BTF_KIND_FLOAT. This series deals with libbpf, bpftool, in-kernel BTF parser as well as selftests and documentation. Ilya Leoshkevich (6): tools/bpftool: Add BTF_KIND_FLOAT support selftests/bpf: Use the 25th bit in the "invalid BTF_INFO" test bpf: Add BTF_KIND_FLOAT support selftest/bpf: Add BTF_KIND_FLOAT tests selftests/bpf: Add BTF_KIND_FLOAT to the existing deduplication tests bpf: Document BTF_KIND_FLOAT in btf.rst Documentation/bpf/btf.rst | 17 +- kernel/bpf/btf.c | 83 ++++++++- tools/bpf/bpftool/btf.c | 8 + tools/bpf/bpftool/btf_dumper.c | 1 + tools/testing/selftests/bpf/btf_helpers.c | 4 + tools/testing/selftests/bpf/prog_tests/btf.c | 176 +++++++++++++++++-- tools/testing/selftests/bpf/test_btf.h | 3 + 7 files changed, 275 insertions(+), 17 deletions(-) -- 2.20.1

1 6

[OLK-5.10,0/3] Fix CVE-2022-2586
by Lu Wei 07 Sep '22

07 Sep '22

Thadeu Lima de Souza Cascardo (3): netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain net/netfilter/nf_tables_api.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) -- 2.31.1

1 3

[PATCH openEuler-5.10-LTS 1/3] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Zheng Zengkai 07 Sep '22

07 Sep '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 560a93aad5b6..7b0497da2d94 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3638,6 +3638,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3648,6 +3649,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3668,7 +3670,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.20.1

1 2

[PATCH openEuler-1.0-LTS 00/64] linux-4.19.y inclusion
by Yongqiang Liu 07 Sep '22

07 Sep '22

*** BLURB HERE *** Chen Zhongjin (2): profiling: fix shift too large makes kernel panic kprobes: Forbid probing on trampoline and BPF code areas Dan Carpenter (1): kfifo: fix kfifo_to_user() return type David Howells (1): vfs: Check the truncate maximum size in inode_newsize_ok() Duoming Zhou (1): mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release Eric Dumazet (1): tcp: fix over estimation in sk_forced_mem_schedule() Eric Whitney (1): ext4: fix extent status tree race in writeback error recovery path Hector Martin (1): locking/atomic: Make test_and_*_bit() ordered on failure Ilpo Järvinen (1): serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() Jason A. Donenfeld (1): fs: check FMODE_LSEEK to control internal pipe splicing Johan Hovold (1): x86/pmem: Fix platform-device leak in error path Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Kuniyuki Iwashima (36): ip: Fix data-races around sysctl_ip_fwd_use_pmtu. ip: Fix data-races around sysctl_ip_nonlocal_bind. ip: Fix a data-race around sysctl_fwmark_reflect. tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. tcp: Fix data-races around sysctl_tcp_mtu_probing. tcp: Fix a data-race around sysctl_tcp_probe_threshold. tcp: Fix a data-race around sysctl_tcp_probe_interval. igmp: Fix data-races around sysctl_igmp_llm_reports. igmp: Fix a data-race around sysctl_igmp_max_memberships. tcp: Fix data-races around sysctl_tcp_reordering. tcp: Fix data-races around some timeout sysctl knobs. tcp: Fix a data-race around sysctl_tcp_notsent_lowat. tcp: Fix a data-race around sysctl_tcp_tw_reuse. tcp: Fix data-races around sysctl_tcp_fastopen. tcp: Fix a data-race around sysctl_tcp_early_retrans. tcp: Fix data-races around sysctl_tcp_recovery. tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. tcp: Fix a data-race around sysctl_tcp_retrans_collapse. tcp: Fix a data-race around sysctl_tcp_stdurg. tcp: Fix a data-race around sysctl_tcp_rfc1337. tcp: Fix data-races around sysctl_tcp_max_reordering. tcp: Fix data-races around sysctl_tcp_dsack. tcp: Fix a data-race around sysctl_tcp_app_win. tcp: Fix a data-race around sysctl_tcp_adv_win_scale. tcp: Fix a data-race around sysctl_tcp_frto. tcp: Fix a data-race around sysctl_tcp_nometrics_save. tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. net: ping6: Fix memleak in ipv6_renew_options(). igmp: Fix data-races around sysctl_igmp_qrv. tcp: Fix a data-race around sysctl_tcp_min_tso_segs. tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. tcp: Fix a data-race around sysctl_tcp_autocorking. tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. Lukas Czerner (1): ext4: make sure ext4_append() always allocates new block Matthias May (1): geneve: do not use RT_TOS for IPv6 flowlabel Miaohe Lin (1): mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region Nicolas Saenz Julienne (1): nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() Theodore Ts'o (1): ext4: update s_overhead_clusters in the superblock during an on-line resize Trond Myklebust (2): NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Uwe Kleine-König (1): mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path Vincent Mailhol (1): can: error: specify the values of data[5..7] of CAN error frames Wang Cheng (1): mm/mempolicy: fix uninit-value in mpol_rebind_policy() Xiu Jianfeng (1): selinux: Add boundary check in put_entry() Yang Xu (1): fs: Add missing umask strip in vfs_tmpfile Yang Yingliang (1): bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() Yonglong Li (1): tcp: make retransmitted SKB fit into the send window Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES huhai (1): ACPI: LPSS: Fix missing check in register_device_clock() Documentation/atomic_bitops.txt | 2 +- arch/x86/kernel/pmem.c | 7 ++++- drivers/acpi/acpi_lpss.c | 3 ++ drivers/bus/hisi_lpc.c | 10 +++--- drivers/mtd/devices/st_spi_fsm.c | 8 +++-- drivers/mtd/sm_ftl.c | 2 +- drivers/net/geneve.c | 3 +- drivers/tty/serial/8250/8250_dw.c | 3 ++ fs/attr.c | 2 ++ fs/ext4/inode.c | 7 +++++ fs/ext4/namei.c | 16 ++++++++++ fs/ext4/resize.c | 11 +++++++ fs/namei.c | 2 ++ fs/nfs/nfs4proc.c | 14 ++++++--- fs/splice.c | 10 +++--- include/asm-generic/bitops/atomic.h | 6 ---- include/linux/kfifo.h | 2 +- include/net/inet_sock.h | 5 +-- include/net/ip.h | 4 +-- include/net/tcp.h | 11 ++++--- include/uapi/linux/can/error.h | 5 ++- kernel/kprobes.c | 3 +- kernel/profile.c | 7 +++++ kernel/sched/rt.c | 15 +++++---- mm/mempolicy.c | 2 +- mm/mmap.c | 1 - net/ipv4/af_inet.c | 2 +- net/ipv4/igmp.c | 47 +++++++++++++++++------------ net/ipv4/route.c | 2 +- net/ipv4/tcp.c | 12 +++++--- net/ipv4/tcp_fastopen.c | 4 +-- net/ipv4/tcp_input.c | 39 ++++++++++++++---------- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_metrics.c | 5 +-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 46 +++++++++++++++++----------- net/ipv4/tcp_recovery.c | 6 ++-- net/ipv4/tcp_timer.c | 14 ++++----- net/ipv6/ping.c | 6 ++++ net/sctp/protocol.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 +++++++++ security/selinux/ss/policydb.h | 2 ++ 42 files changed, 240 insertions(+), 126 deletions(-) -- 2.25.1

1 64

[PATCH openEuler-1.0-LTS 00/13] ACPI and block bugfix from mainline
by Yongqiang Liu 07 Sep '22

07 Sep '22

Chunguang Xu (1): block: fix the problem of io_ticks becoming smaller Dan Carpenter (1): acpi/nfit: improve bounds checking for 'func' Erik Kaneda (2): ACPICA: Do not increment operation_region reference counts for field units ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 Francesco Pollicino (1): block, bfq: save & resume weight on a queue merge/split Jiasheng Jiang (1): ACPI: APD: Check for NULL pointer after calling devm_ioremap() Mark Langsdorf (2): ACPI: custom_method: fix a possible memory leak ACPI: custom_method: fix potential use-after-free issue Maximilian Luz (1): ACPICA: Fix exception code class checks Qinglang Miao (1): ACPI: configfs: add missing check after configfs_register_default_group() Robin Murphy (1): ACPI/IORT: Check node revision for PMCG resources Tuan Phan (1): ACPI/IORT: Fix PMCG node single ID mapping handling zhengbin (1): blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling block/bfq-iosched.c | 2 ++ block/bfq-iosched.h | 9 +++++++++ block/bio.c | 2 +- block/blk-mq.c | 9 ++++++--- drivers/acpi/acpi_apd.c | 2 ++ drivers/acpi/acpi_configfs.c | 7 ++++++- drivers/acpi/acpica/dsfield.c | 2 +- drivers/acpi/acpica/dswload.c | 21 +++++++++++++++++++++ drivers/acpi/acpica/exprep.c | 4 ---- drivers/acpi/acpica/utdelete.c | 6 +----- drivers/acpi/arm64/iort.c | 19 ++++++++++++++++--- drivers/acpi/custom_method.c | 4 +++- drivers/acpi/nfit/core.c | 7 ++++--- drivers/acpi/nfit/nfit.h | 1 + include/acpi/acexcep.h | 10 +++++----- 15 files changed, 78 insertions(+), 27 deletions(-) -- 2.25.1

1 13

[PATCH openEuler-1.0-LTS 0/4] fix openEuler-1.0-LTS
by tangbin 07 Sep '22

07 Sep '22

When use openEuler-1.0-LTS kernel in euler22.03, we found it unable to compile and boot, thus fix it. Andy Lutomirski (1): x86/entry/64: Don't compile ignore_sysret if 32-bit emulation is enabled Aristeu Rozanski (1): EDAC: skx_common: downgrade message importance on missing PCI device Borislav Petkov (1): x86: Fix early boot crash on gcc-10, third try Josh Poimboeuf (1): objtool: Don't fail on missing symbol table arch/x86/entry/entry_64.S | 6 ++++++ arch/x86/include/asm/stackprotector.h | 7 ++++++- arch/x86/kernel/smpboot.c | 8 ++++++++ arch/x86/xen/smp_pv.c | 1 + drivers/edac/skx_common.c | 2 +- include/linux/compiler.h | 6 ++++++ init/main.c | 2 ++ tools/objtool/elf.c | 7 +++++-- 8 files changed, 35 insertions(+), 4 deletions(-) -- 2.18.4

1 4

[PATCH openEuler-1.0-LTS 1/3] usb: gadget: function: printer: fix use-after-free in __lock_acquire
by Yongqiang Liu 07 Sep '22

07 Sep '22

From: Zqiang <qiang.zhang(a)windriver.com> stable inclusion from stable-v4.19.154 commit cedb0187b8ba929c3f76f28e6bc25804d65f8a54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PB1E CVE: CVE-2020-27784 --------------------------- [ Upstream commit e8d5f92b8d30bb4ade76494490c3c065e12411b1 ] Fix this by increase object reference count. BUG: KASAN: use-after-free in __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 Read of size 8 at addr ffff8880683b0018 by task syz-executor.0/3377 CPU: 1 PID: 3377 Comm: syz-executor.0 Not tainted 5.6.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 lock_acquire+0x127/0x350 kernel/locking/lockdep.c:4488 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 printer_ioctl+0x4a/0x110 drivers/usb/gadget/function/f_printer.c:723 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0xfb/0x130 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4531a9 Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fd14ad72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 00000000004531a9 RDX: fffffffffffffff9 RSI: 000000000000009e RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbd61 R13: 00000000004d0a98 R14: 00007fd14ad736d4 R15: 00000000ffffffff Allocated by task 2393: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:515 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2813 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] gprinter_alloc+0xa1/0x870 drivers/usb/gadget/function/f_printer.c:1416 usb_get_function+0x58/0xc0 drivers/usb/gadget/functions.c:61 config_usb_cfg_link+0x1ed/0x3e0 drivers/usb/gadget/configfs.c:444 configfs_symlink+0x527/0x11d0 fs/configfs/symlink.c:202 vfs_symlink+0x33d/0x5b0 fs/namei.c:4201 do_symlinkat+0x11b/0x1d0 fs/namei.c:4228 __do_sys_symlinkat fs/namei.c:4242 [inline] __se_sys_symlinkat fs/namei.c:4239 [inline] __x64_sys_symlinkat+0x73/0xb0 fs/namei.c:4239 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 3368: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x135/0x190 mm/kasan/common.c:476 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485 slab_free_hook mm/slub.c:1444 [inline] slab_free_freelist_hook mm/slub.c:1477 [inline] slab_free mm/slub.c:3034 [inline] kfree+0xf7/0x410 mm/slub.c:3995 gprinter_free+0x49/0xd0 drivers/usb/gadget/function/f_printer.c:1353 usb_put_function+0x38/0x50 drivers/usb/gadget/functions.c:87 config_usb_cfg_unlink+0x2db/0x3b0 drivers/usb/gadget/configfs.c:485 configfs_unlink+0x3b9/0x7f0 fs/configfs/symlink.c:250 vfs_unlink+0x287/0x570 fs/namei.c:4073 do_unlinkat+0x4f9/0x620 fs/namei.c:4137 __do_sys_unlink fs/namei.c:4184 [inline] __se_sys_unlink fs/namei.c:4182 [inline] __x64_sys_unlink+0x42/0x50 fs/namei.c:4182 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880683b0000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 24 bytes inside of 1024-byte region [ffff8880683b0000, ffff8880683b0400) The buggy address belongs to the page: page:ffffea0001a0ec00 refcount:1 mapcount:0 mapping:ffff88806c00e300 index:0xffff8880683b1800 compound_mapcount: 0 flags: 0x100000000010200(slab|head) raw: 0100000000010200 0000000000000000 0000000600000001 ffff88806c00e300 raw: ffff8880683b1800 000000008010000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Reported-by: Kyungtae Kim <kt0755(a)gmail.com> Signed-off-by: Zqiang <qiang.zhang(a)windriver.com> Signed-off-by: Felipe Balbi <balbi(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/gadget/function/f_printer.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c index 9c7ed2539ff7..8ed1295d7e35 100644 --- a/drivers/usb/gadget/function/f_printer.c +++ b/drivers/usb/gadget/function/f_printer.c @@ -31,6 +31,7 @@ #include <linux/types.h> #include <linux/ctype.h> #include <linux/cdev.h> +#include <linux/kref.h> #include <asm/byteorder.h> #include <linux/io.h> @@ -64,7 +65,7 @@ struct printer_dev { struct usb_gadget *gadget; s8 interface; struct usb_ep *in_ep, *out_ep; - + struct kref kref; struct list_head rx_reqs; /* List of free RX structs */ struct list_head rx_reqs_active; /* List of Active RX xfers */ struct list_head rx_buffers; /* List of completed xfers */ @@ -218,6 +219,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, /*-------------------------------------------------------------------------*/ +static void printer_dev_free(struct kref *kref) +{ + struct printer_dev *dev = container_of(kref, struct printer_dev, kref); + + kfree(dev); +} + static struct usb_request * printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags) { @@ -348,6 +356,7 @@ printer_open(struct inode *inode, struct file *fd) spin_unlock_irqrestore(&dev->lock, flags); + kref_get(&dev->kref); DBG(dev, "printer_open returned %x\n", ret); return ret; } @@ -365,6 +374,7 @@ printer_close(struct inode *inode, struct file *fd) dev->printer_status &= ~PRINTER_SELECTED; spin_unlock_irqrestore(&dev->lock, flags); + kref_put(&dev->kref, printer_dev_free); DBG(dev, "printer_close\n"); return 0; @@ -1350,7 +1360,8 @@ static void gprinter_free(struct usb_function *f) struct f_printer_opts *opts; opts = container_of(f->fi, struct f_printer_opts, func_inst); - kfree(dev); + + kref_put(&dev->kref, printer_dev_free); mutex_lock(&opts->lock); --opts->refcnt; mutex_unlock(&opts->lock); @@ -1419,6 +1430,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) return ERR_PTR(-ENOMEM); } + kref_init(&dev->kref); ++opts->refcnt; dev->minor = opts->minor; dev->pnp_string = opts->pnp_string; -- 2.25.1

1 2

[PATCH openEuler-5.10 01/14] tty: drivers/tty/, stop using tty_schedule_flip()
by Zheng Zengkai 06 Sep '22

06 Sep '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-v5.10.134 commit 6a81848252869d929354a879e08807c932444929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5Y1 CVE: CVE-2022-1462 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5f6a85158ccacc3f09744b3aafe8b11ab3b6c6f6 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in drivers/tty/. Cc: Vladimir Zapolskiy <vz(a)mleia.com> Reviewed-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20211122111648.30379-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/tty/cyclades.c | 6 +++--- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 ++-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/vt/keyboard.c | 6 +++--- drivers/tty/vt/vt.c | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c index 097266342e5e..4bcaab250676 100644 --- a/drivers/tty/cyclades.c +++ b/drivers/tty/cyclades.c @@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_card *cinfo, int chip, } info->idle_stats.recv_idle = jiffies; } - tty_schedule_flip(port); + tty_flip_buffer_push(port); /* end of service */ cyy_writeb(info, CyRIR, save_xir & 0x3f); @@ -996,7 +996,7 @@ static void cyz_handle_rx(struct cyclades_port *info) mod_timer(&info->rx_full_timer, jiffies + 1); #endif info->idle_stats.recv_idle = jiffies; - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); /* Update rx_get */ cy_writel(&buf_ctrl->rx_get, new_rx_get); @@ -1172,7 +1172,7 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo) if (delta_count) wake_up_interruptible(&info->port.delta_msr_wait); if (special_count) - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); } } diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index c8c5cdfc5e19..ed0f3a7b8fe5 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -151,7 +151,7 @@ static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id) address = (unsigned long)(void *)buf; goldfish_tty_rw(qtty, address, count, 0); - tty_schedule_flip(&qtty->port); + tty_flip_buffer_push(&qtty->port); return IRQ_HANDLED; } diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c index f9f14104bd2c..d6528f3bb9b9 100644 --- a/drivers/tty/moxa.c +++ b/drivers/tty/moxa.c @@ -1385,7 +1385,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (inited && !tty_throttled(tty) && MoxaPortRxQueue(p) > 0) { /* RX */ MoxaPortReadData(p); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } } else { clear_bit(EMPTYWAIT, &p->statusflags); @@ -1410,7 +1410,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */ tty_insert_flip_char(&p->port, 0, TTY_BREAK); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } if (intr & IntrLine) diff --git a/drivers/tty/serial/lpc32xx_hs.c b/drivers/tty/serial/lpc32xx_hs.c index b5898c932036..a9802308ff60 100644 --- a/drivers/tty/serial/lpc32xx_hs.c +++ b/drivers/tty/serial/lpc32xx_hs.c @@ -344,7 +344,7 @@ static irqreturn_t serial_lpc32xx_interrupt(int irq, void *dev_id) LPC32XX_HSUART_IIR(port->membase)); port->icount.overrun++; tty_insert_flip_char(tport, 0, TTY_OVERRUN); - tty_schedule_flip(tport); + tty_flip_buffer_push(tport); } /* Data received? */ diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 78acc270e39a..aa0026a9839c 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -311,7 +311,7 @@ int kbd_rate(struct kbd_repeat *rpt) static void put_queue(struct vc_data *vc, int ch) { tty_insert_flip_char(&vc->port, ch, 0); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void puts_queue(struct vc_data *vc, char *cp) @@ -320,7 +320,7 @@ static void puts_queue(struct vc_data *vc, char *cp) tty_insert_flip_char(&vc->port, *cp, 0); cp++; } - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void applkey(struct vc_data *vc, int key, char mode) @@ -565,7 +565,7 @@ static void fn_inc_console(struct vc_data *vc) static void fn_send_intr(struct vc_data *vc) { tty_insert_flip_char(&vc->port, 0, TTY_BREAK); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void fn_scroll_forw(struct vc_data *vc) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0a6336d54a65..30fc2a60c352 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1834,7 +1834,7 @@ static void csi_m(struct vc_data *vc) static void respond_string(const char *p, size_t len, struct tty_port *port) { tty_insert_flip_string(port, p, len); - tty_schedule_flip(port); + tty_flip_buffer_push(port); } static void cursor_report(struct vc_data *vc, struct tty_struct *tty) -- 2.20.1

1 13

[PATCH openEuler-5.10 00/44] Backport 5.10.120 LTS
by Zheng Zengkai 06 Sep '22

06 Sep '22

Backport 5.10.120 LTS patches from upstream. git cherry-pick v5.10.119..v5.10.120~1 -s Already merged(-8): ea62d169b6e7 netfilter: nf_tables: disallow non-stateful expression in sets earlier 57d01bcae704 io_uring: don't re-import iovecs from callbacks 8adb751d294e io_uring: fix using under-expanded iters 72464fd2b4b7 xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks a9e7f19a5577 xfs: fix an ABBA deadlock in xfs_renam 2728d95c6c95 xfs: Fix CIL throttle hang when CIL space used going backwards c0aff1faf66b netfilter: nf_tables: sanitize nft_set_desc_concat_parse() 3d8fc6e28f32 KVM: x86: avoid calling x86 emulator without a decoded instruction Skiped(-1)： 45d97f70da4d xfs: show the proper user quota options Context conflict: 630192aa4523 lib/crypto: add prompts back to crypto libraries 8df42bcd364c dm verity: set DM_TARGET_IMMUTABLE feature flag KABI fixed(+1): pipe: fix kabi for poll_usage in struct pipe_inode_info Total patches: 52 - 8 - 1 + 1= 44 Akira Yokosawa (1): docs: submitting-patches: Fix crossref to 'The canonical patch format' Al Viro (1): percpu_ref_init(): clean ->percpu_count_ref on failure Alex Elder (1): net: ipa: compute proper aggregation limit Chuck Lever (1): NFSD: Fix possible sleep during nfsd4_release_lockowner() Dan Carpenter (1): dm integrity: fix error code in dm_integrity_ctr() Darrick J. Wong (1): xfs: detect overflows in bmbt records David Howells (1): pipe: Fix missing lock in pipe_resize_ring() Fabio Estevam (1): crypto: caam - fix i.MX6SX entropy delay value Florian Westphal (1): netfilter: conntrack: re-fetch conntrack after insertion Gustavo A. R. Silva (1): drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() IotaHydrae (1): pinctrl: sunxi: fix f1c100s uart2 function Joel Stanley (1): net: ftgmac100: Disable hardware checksum on AST2600 Jonathan Bakker (1): ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries Justin M. Forbes (1): lib/crypto: add prompts back to crypto libraries Kuniyuki Iwashima (1): pipe: make poll_usage boolean and annotate its access Lin Ma (1): nfc: pn533: Fix buggy cleanup order Liu Jian (1): bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes Marek Maślanka (1): HID: multitouch: Add support for Google Whiskers Touchpad Mariusz Tkaczyk (1): raid5: introduce MD_BROKEN Mika Westerberg (1): i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging Mikulas Patocka (2): dm crypt: make printing of the key constant-time dm stats: add cond_resched when looping over entries Miri Korenblit (1): cfg80211: set custom regdomain after wiphy registration Nicolai Stange (4): crypto: drbg - prepare for more fine-grained tracking of seeding state crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() crypto: drbg - make reseeding from get_random_bytes() synchronous Paolo Bonzini (1): x86, kvm: use correct GFP flags for preemption disabled Piyush Malgujar (1): drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers Sarthak Kukreti (1): dm verity: set DM_TARGET_IMMUTABLE feature flag Sean Christopherson (1): x86/kvm: Alloc dummy async #PF token outside of raw spinlock Stefan Mahnke-Hartmann (1): tpm: Fix buffer access in tpm2_get_tpm_pt() Stephen Brennan (1): assoc_array: Fix BUG_ON during garbage collect Steven Rostedt (1): Bluetooth: hci_qca: Use del_timer_sync() before freeing Sultan Alsawaf (1): zsmalloc: fix races between asynchronous zspage free and page migration Tadeusz Struk (1): exfat: check if cluster num is valid Tao Jin (1): HID: multitouch: add quirks to enable Lenovo X12 trackpoint Thomas Bartschies (1): net: af_key: check encryption module availability consistency Trond Myklebust (1): NFS: Memory allocation failures are not server fatal errors Vitaly Chikunov (1): crypto: ecrdsa - Fix incorrect use of vli_cmp Xiaomeng Tong (1): KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator Xiu Jianfeng (1): tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() Yuntao Wang (1): bpf: Fix potential array overflow in bpf_trampoline_get_progs() Zheng Zengkai (1): pipe: fix kabi for poll_usage in struct pipe_inode_info Documentation/process/submitting-patches.rst | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- arch/powerpc/kvm/book3s_hv_uvmem.c | 8 +- arch/x86/kernel/kvm.c | 41 ++++--- crypto/Kconfig | 2 - crypto/drbg.c | 110 +++++++----------- crypto/ecrdsa.c | 8 +- drivers/bluetooth/hci_qca.c | 4 +- drivers/char/random.c | 2 - drivers/char/tpm/tpm2-cmd.c | 11 +- drivers/char/tpm/tpm_ibmvtpm.c | 1 + drivers/crypto/caam/ctrl.c | 18 +++ drivers/gpu/drm/i915/intel_pm.c | 2 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 9 ++ drivers/i2c/busses/i2c-ismt.c | 14 +++ drivers/i2c/busses/i2c-thunderx-pcidrv.c | 1 + drivers/md/dm-crypt.c | 14 ++- drivers/md/dm-integrity.c | 2 - drivers/md/dm-stats.c | 8 ++ drivers/md/dm-verity-target.c | 1 + drivers/md/raid5.c | 47 ++++---- drivers/net/ethernet/faraday/ftgmac100.c | 5 + drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/nfc/pn533/pn533.c | 5 +- drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c | 2 +- fs/exfat/balloc.c | 8 +- fs/exfat/exfat_fs.h | 8 ++ fs/exfat/fatent.c | 8 -- fs/nfs/internal.h | 1 + fs/nfsd/nfs4state.c | 12 +- fs/pipe.c | 33 +++--- fs/xfs/libxfs/xfs_bmap.c | 5 + include/crypto/drbg.h | 10 +- include/linux/pipe_fs_i.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 7 +- kernel/bpf/trampoline.c | 18 ++- lib/Kconfig | 2 + lib/assoc_array.c | 8 ++ lib/crypto/Kconfig | 17 ++- lib/percpu-refcount.c | 1 + mm/zsmalloc.c | 37 +++++- net/core/filter.c | 4 +- net/key/af_key.c | 6 +- net/wireless/core.c | 8 +- net/wireless/reg.c | 1 + 46 files changed, 328 insertions(+), 192 deletions(-) -- 2.20.1

1 44

[PATCH openEuler-1.0-LTS 1/2] lightnvm: disable the subsystem
by Yongqiang Liu 06 Sep '22

06 Sep '22

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v5.10.114 commit 549209caabc89f2877ad5f62d11fca5c052e0e8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5O6A9 CVE: CVE-2022-2991 --------------------------- In commit 9ea9b9c48387 ("remove the lightnvm subsystem") the lightnvm subsystem was removed as there is no hardware in the wild for it, and the code is known to have problems. This should also be disabled for older LTS kernels as well to prevent anyone from accidentally using it. Cc: Christoph Hellwig <hch(a)lst.de> Cc: Matias Bjørling <mb(a)lightnvm.io> Cc: Javier González <javier(a)javigon.com> Cc: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/lightnvm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig index 439bf90d084d..1db33cb28859 100644 --- a/drivers/lightnvm/Kconfig +++ b/drivers/lightnvm/Kconfig @@ -4,7 +4,7 @@ menuconfig NVM bool "Open-Channel SSD target support" - depends on BLOCK && PCI + depends on BLOCK && PCI && BROKEN select BLK_DEV_NVME help Say Y here to get to enable Open-channel SSDs. -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/6] configfs: return -ENAMETOOLONG earlier in configfs_lookup
by Yongqiang Liu 06 Sep '22

06 Sep '22

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v5.15-rc1 commit 417b962ddeca2b70eb72d28c87541bdad4e234f8 category: bugfix bugzilla: 187567, https://gitee.com/openeuler/kernel/issues/I5PK1G CVE: NA -------------------------------- Just like most other file systems: get the simple checks out of the way first. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/configfs/dir.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 9b43611e1bb3..ff298a9baa0a 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -483,6 +483,9 @@ static struct dentry * configfs_lookup(struct inode *dir, int found = 0; int err; + if (dentry->d_name.len > NAME_MAX) + return ERR_PTR(-ENAMETOOLONG); + /* * Fake invisibility if dir belongs to a group/default groups hierarchy * being attached @@ -513,8 +516,6 @@ static struct dentry * configfs_lookup(struct inode *dir, * If it doesn't exist and it isn't a NOT_PINNED item, * it must be negative. */ - if (dentry->d_name.len > NAME_MAX) - return ERR_PTR(-ENAMETOOLONG); d_add(dentry, NULL); return NULL; } -- 2.25.1

1 5

[PATCH openEuler-5.10-LTS 01/12] tty: drivers/tty/, stop using tty_schedule_flip()
by Zheng Zengkai 06 Sep '22

06 Sep '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-v5.10.134 commit 6a81848252869d929354a879e08807c932444929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5Y1 CVE: CVE-2022-1462 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5f6a85158ccacc3f09744b3aafe8b11ab3b6c6f6 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in drivers/tty/. Cc: Vladimir Zapolskiy <vz(a)mleia.com> Reviewed-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20211122111648.30379-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/tty/cyclades.c | 6 +++--- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 ++-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/vt/keyboard.c | 6 +++--- drivers/tty/vt/vt.c | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c index 097266342e5e..4bcaab250676 100644 --- a/drivers/tty/cyclades.c +++ b/drivers/tty/cyclades.c @@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_card *cinfo, int chip, } info->idle_stats.recv_idle = jiffies; } - tty_schedule_flip(port); + tty_flip_buffer_push(port); /* end of service */ cyy_writeb(info, CyRIR, save_xir & 0x3f); @@ -996,7 +996,7 @@ static void cyz_handle_rx(struct cyclades_port *info) mod_timer(&info->rx_full_timer, jiffies + 1); #endif info->idle_stats.recv_idle = jiffies; - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); /* Update rx_get */ cy_writel(&buf_ctrl->rx_get, new_rx_get); @@ -1172,7 +1172,7 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo) if (delta_count) wake_up_interruptible(&info->port.delta_msr_wait); if (special_count) - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); } } diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index c8c5cdfc5e19..ed0f3a7b8fe5 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -151,7 +151,7 @@ static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id) address = (unsigned long)(void *)buf; goldfish_tty_rw(qtty, address, count, 0); - tty_schedule_flip(&qtty->port); + tty_flip_buffer_push(&qtty->port); return IRQ_HANDLED; } diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c index f9f14104bd2c..d6528f3bb9b9 100644 --- a/drivers/tty/moxa.c +++ b/drivers/tty/moxa.c @@ -1385,7 +1385,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (inited && !tty_throttled(tty) && MoxaPortRxQueue(p) > 0) { /* RX */ MoxaPortReadData(p); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } } else { clear_bit(EMPTYWAIT, &p->statusflags); @@ -1410,7 +1410,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */ tty_insert_flip_char(&p->port, 0, TTY_BREAK); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } if (intr & IntrLine) diff --git a/drivers/tty/serial/lpc32xx_hs.c b/drivers/tty/serial/lpc32xx_hs.c index b5898c932036..a9802308ff60 100644 --- a/drivers/tty/serial/lpc32xx_hs.c +++ b/drivers/tty/serial/lpc32xx_hs.c @@ -344,7 +344,7 @@ static irqreturn_t serial_lpc32xx_interrupt(int irq, void *dev_id) LPC32XX_HSUART_IIR(port->membase)); port->icount.overrun++; tty_insert_flip_char(tport, 0, TTY_OVERRUN); - tty_schedule_flip(tport); + tty_flip_buffer_push(tport); } /* Data received? */ diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 78acc270e39a..aa0026a9839c 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -311,7 +311,7 @@ int kbd_rate(struct kbd_repeat *rpt) static void put_queue(struct vc_data *vc, int ch) { tty_insert_flip_char(&vc->port, ch, 0); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void puts_queue(struct vc_data *vc, char *cp) @@ -320,7 +320,7 @@ static void puts_queue(struct vc_data *vc, char *cp) tty_insert_flip_char(&vc->port, *cp, 0); cp++; } - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void applkey(struct vc_data *vc, int key, char mode) @@ -565,7 +565,7 @@ static void fn_inc_console(struct vc_data *vc) static void fn_send_intr(struct vc_data *vc) { tty_insert_flip_char(&vc->port, 0, TTY_BREAK); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void fn_scroll_forw(struct vc_data *vc) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0a6336d54a65..30fc2a60c352 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1834,7 +1834,7 @@ static void csi_m(struct vc_data *vc) static void respond_string(const char *p, size_t len, struct tty_port *port) { tty_insert_flip_string(port, p, len); - tty_schedule_flip(port); + tty_flip_buffer_push(port); } static void cursor_report(struct vc_data *vc, struct tty_struct *tty) -- 2.20.1

1 11

[PATCH openEuler-5.10-LTS 00/44] Backport 5.10.120 LTS
by Zheng Zengkai 06 Sep '22

06 Sep '22

Backport 5.10.120 LTS patches from upstream. git cherry-pick v5.10.119..v5.10.120~1 -s Already merged(-8): ea62d169b6e7 netfilter: nf_tables: disallow non-stateful expression in sets earlier 57d01bcae704 io_uring: don't re-import iovecs from callbacks 8adb751d294e io_uring: fix using under-expanded iters 72464fd2b4b7 xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks a9e7f19a5577 xfs: fix an ABBA deadlock in xfs_renam 2728d95c6c95 xfs: Fix CIL throttle hang when CIL space used going backwards c0aff1faf66b netfilter: nf_tables: sanitize nft_set_desc_concat_parse() 3d8fc6e28f32 KVM: x86: avoid calling x86 emulator without a decoded instruction Skiped(-1)： 45d97f70da4d xfs: show the proper user quota options Context conflict: 630192aa4523 lib/crypto: add prompts back to crypto libraries 8df42bcd364c dm verity: set DM_TARGET_IMMUTABLE feature flag KABI fixed(+1): pipe: fix kabi for poll_usage in struct pipe_inode_info Total patches: 52 - 8 - 1 + 1= 44 Akira Yokosawa (1): docs: submitting-patches: Fix crossref to 'The canonical patch format' Al Viro (1): percpu_ref_init(): clean ->percpu_count_ref on failure Alex Elder (1): net: ipa: compute proper aggregation limit Chuck Lever (1): NFSD: Fix possible sleep during nfsd4_release_lockowner() Dan Carpenter (1): dm integrity: fix error code in dm_integrity_ctr() Darrick J. Wong (1): xfs: detect overflows in bmbt records David Howells (1): pipe: Fix missing lock in pipe_resize_ring() Fabio Estevam (1): crypto: caam - fix i.MX6SX entropy delay value Florian Westphal (1): netfilter: conntrack: re-fetch conntrack after insertion Gustavo A. R. Silva (1): drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() IotaHydrae (1): pinctrl: sunxi: fix f1c100s uart2 function Joel Stanley (1): net: ftgmac100: Disable hardware checksum on AST2600 Jonathan Bakker (1): ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries Justin M. Forbes (1): lib/crypto: add prompts back to crypto libraries Kuniyuki Iwashima (1): pipe: make poll_usage boolean and annotate its access Lin Ma (1): nfc: pn533: Fix buggy cleanup order Liu Jian (1): bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes Marek Maślanka (1): HID: multitouch: Add support for Google Whiskers Touchpad Mariusz Tkaczyk (1): raid5: introduce MD_BROKEN Mika Westerberg (1): i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging Mikulas Patocka (2): dm crypt: make printing of the key constant-time dm stats: add cond_resched when looping over entries Miri Korenblit (1): cfg80211: set custom regdomain after wiphy registration Nicolai Stange (4): crypto: drbg - prepare for more fine-grained tracking of seeding state crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() crypto: drbg - make reseeding from get_random_bytes() synchronous Paolo Bonzini (1): x86, kvm: use correct GFP flags for preemption disabled Piyush Malgujar (1): drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers Sarthak Kukreti (1): dm verity: set DM_TARGET_IMMUTABLE feature flag Sean Christopherson (1): x86/kvm: Alloc dummy async #PF token outside of raw spinlock Stefan Mahnke-Hartmann (1): tpm: Fix buffer access in tpm2_get_tpm_pt() Stephen Brennan (1): assoc_array: Fix BUG_ON during garbage collect Steven Rostedt (1): Bluetooth: hci_qca: Use del_timer_sync() before freeing Sultan Alsawaf (1): zsmalloc: fix races between asynchronous zspage free and page migration Tadeusz Struk (1): exfat: check if cluster num is valid Tao Jin (1): HID: multitouch: add quirks to enable Lenovo X12 trackpoint Thomas Bartschies (1): net: af_key: check encryption module availability consistency Trond Myklebust (1): NFS: Memory allocation failures are not server fatal errors Vitaly Chikunov (1): crypto: ecrdsa - Fix incorrect use of vli_cmp Xiaomeng Tong (1): KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator Xiu Jianfeng (1): tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() Yuntao Wang (1): bpf: Fix potential array overflow in bpf_trampoline_get_progs() Zheng Zengkai (1): pipe: fix kabi for poll_usage in struct pipe_inode_info Documentation/process/submitting-patches.rst | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- arch/powerpc/kvm/book3s_hv_uvmem.c | 8 +- arch/x86/kernel/kvm.c | 41 ++++--- crypto/Kconfig | 2 - crypto/drbg.c | 110 +++++++----------- crypto/ecrdsa.c | 8 +- drivers/bluetooth/hci_qca.c | 4 +- drivers/char/random.c | 2 - drivers/char/tpm/tpm2-cmd.c | 11 +- drivers/char/tpm/tpm_ibmvtpm.c | 1 + drivers/crypto/caam/ctrl.c | 18 +++ drivers/gpu/drm/i915/intel_pm.c | 2 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 9 ++ drivers/i2c/busses/i2c-ismt.c | 14 +++ drivers/i2c/busses/i2c-thunderx-pcidrv.c | 1 + drivers/md/dm-crypt.c | 14 ++- drivers/md/dm-integrity.c | 2 - drivers/md/dm-stats.c | 8 ++ drivers/md/dm-verity-target.c | 1 + drivers/md/raid5.c | 47 ++++---- drivers/net/ethernet/faraday/ftgmac100.c | 5 + drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/nfc/pn533/pn533.c | 5 +- drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c | 2 +- fs/exfat/balloc.c | 8 +- fs/exfat/exfat_fs.h | 8 ++ fs/exfat/fatent.c | 8 -- fs/nfs/internal.h | 1 + fs/nfsd/nfs4state.c | 12 +- fs/pipe.c | 33 +++--- fs/xfs/libxfs/xfs_bmap.c | 5 + include/crypto/drbg.h | 10 +- include/linux/pipe_fs_i.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 7 +- kernel/bpf/trampoline.c | 18 ++- lib/Kconfig | 2 + lib/assoc_array.c | 8 ++ lib/crypto/Kconfig | 17 ++- lib/percpu-refcount.c | 1 + mm/zsmalloc.c | 37 +++++- net/core/filter.c | 4 +- net/key/af_key.c | 6 +- net/wireless/core.c | 8 +- net/wireless/reg.c | 1 + 46 files changed, 328 insertions(+), 192 deletions(-) -- 2.20.1

1 44

[PATCH openEuler-1.0-LTS 1/3] af_key: Do not call xfrm_probe_algs in parallel
by Yongqiang Liu 05 Sep '22

05 Sep '22

From: Herbert Xu <herbert(a)gondor.apana.org.au> mainline inclusion from mainline-v6.0-rc3 commit ba953a9d89a00c078b85f4b190bc1dde66fe16b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5OPA4 CVE: CVE-2022-3028 -------------------------------- When namespace support was added to xfrm/afkey, it caused the previously single-threaded call to xfrm_probe_algs to become multi-threaded. This is buggy and needs to be fixed with a mutex. Reported-by: Abhishek Shah <abhishek.shah(a)columbia.edu> Fixes: 283bc9f35bbb ("xfrm: Namespacify xfrm state/policy locks") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/key/af_key.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/key/af_key.c b/net/key/af_key.c index 0107cc10c4a2..23470b0d84aa 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1707,9 +1707,12 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad pfk->registered |= (1<<hdr->sadb_msg_satype); } + mutex_lock(&pfkey_mutex); xfrm_probe_algs(); supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); + mutex_unlock(&pfkey_mutex); + if (!supp_skb) { if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) pfk->registered &= ~(1<<hdr->sadb_msg_satype); -- 2.25.1

1 2

[PATCH openEuler-5.10 01/10] Revert "NFS: Use of mapping_set_error() results in spurious errors"
by Zheng Zengkai 01 Sep '22

01 Sep '22

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5KK4D CVE: NA -------------------------------- This reverts commit f4f117026d586db38c025cd95b6094ff8de326df. 7f3945b4aab5 (NFS: Use of mapping_set_error() results in spurious errors) delete mappint->flags because of 67dd23f9e6fb (nfs: ensure correct writeback errors are returned on close()). However 67dd23f9e6fb has been reverted, use mappint->flags to return error. Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/nfs/write.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 5d07799513a6..e8f6ce88b1fb 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -310,10 +310,7 @@ static void nfs_mapping_set_error(struct page *page, int error) struct address_space *mapping = page_file_mapping(page); SetPageError(page); - filemap_set_wb_err(mapping, error); - if (mapping->host) - errseq_set(&mapping->host->i_sb->s_wb_err, - error == -ENOSPC ? -ENOSPC : -EIO); + mapping_set_error(mapping, error); nfs_set_pageerror(mapping); } -- 2.20.1

1 9

openEuler Kernel SIG例会
by openEuler conference 01 Sep '22

01 Sep '22

您好！ Kernel SIG 邀请您参加 2022-09-02 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.AMD EPYC Gen4 Genoa平台openEuler-22.09支持简介 2.申威openEuler-22.09内核特性介绍会议链接：https://us06web.zoom.us/j/85985675927?pwd=ZXl4K3hzZWRpTUIvUWR6RkJJalpPdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-09-02 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.AMD EPYC Gen4 Genoa平台openEuler-22.09支持简介 2.申威openEuler-22.09内核特性介绍 You can join the meeting at https://us06web.zoom.us/j/85985675927?pwd=ZXl4K3hzZWRpTUIvUWR6RkJJalpPdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/3] net: usb: ax88179_178a: fix packet alignment padding
by Yongqiang Liu 01 Sep '22

01 Sep '22

From: Jeremy Kerr <jk(a)ozlabs.org> stable inclusion from stable-v4.19.131 commit c191f7cf369c0090fdbeff0b6782d5eaa3a179d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5NYS6 CVE: CVE-2022-2964 --------------------------- [ Upstream commit e869e7a17798d85829fa7d4f9bbe1eebd4b2d3f6 ] Using a AX88179 device (0b95:1790), I see two bytes of appended data on every RX packet. For example, this 48-byte ping, using 0xff as a payload byte: 04:20:22.528472 IP 192.168.1.1 > 192.168.1.2: ICMP echo request, id 2447, seq 1, length 64 0x0000: 000a cd35 ea50 000a cd35 ea4f 0800 4500 0x0010: 0054 c116 4000 4001 f63e c0a8 0101 c0a8 0x0020: 0102 0800 b633 098f 0001 87ea cd5e 0000 0x0030: 0000 dcf2 0600 0000 0000 ffff ffff ffff 0x0040: ffff ffff ffff ffff ffff ffff ffff ffff 0x0050: ffff ffff ffff ffff ffff ffff ffff ffff 0x0060: ffff 961f Those last two bytes - 96 1f - aren't part of the original packet. In the ax88179 RX path, the usbnet rx_fixup function trims a 2-byte 'alignment pseudo header' from the start of the packet, and sets the length from a per-packet field populated by hardware. It looks like that length field *includes* the 2-byte header; the current driver assumes that it's excluded. This change trims the 2-byte alignment header after we've set the packet length, so the resulting packet length is correct. While we're moving the comment around, this also fixes the spelling of 'pseudo'. Signed-off-by: Jeremy Kerr <jk(a)ozlabs.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> (cherry picked from commit c191f7cf369c0090fdbeff0b6782d5eaa3a179d2) Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/usb/ax88179_178a.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c index 2207f7a7d1ff..8455f72007b9 100644 --- a/drivers/net/usb/ax88179_178a.c +++ b/drivers/net/usb/ax88179_178a.c @@ -1400,10 +1400,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) } if (pkt_cnt == 0) { - /* Skip IP alignment psudo header */ - skb_pull(skb, 2); skb->len = pkt_len; - skb_set_tail_pointer(skb, pkt_len); + /* Skip IP alignment pseudo header */ + skb_pull(skb, 2); + skb_set_tail_pointer(skb, skb->len); skb->truesize = pkt_len + sizeof(struct sk_buff); ax88179_rx_checksum(skb, pkt_hdr); return 1; @@ -1412,8 +1412,9 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) ax_skb = skb_clone(skb, GFP_ATOMIC); if (ax_skb) { ax_skb->len = pkt_len; - ax_skb->data = skb->data + 2; - skb_set_tail_pointer(ax_skb, pkt_len); + /* Skip IP alignment pseudo header */ + skb_pull(ax_skb, 2); + skb_set_tail_pointer(ax_skb, ax_skb->len); ax_skb->truesize = pkt_len + sizeof(struct sk_buff); ax88179_rx_checksum(ax_skb, pkt_hdr); usbnet_skb_return(dev, ax_skb); -- 2.25.1

1 7