September 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
by Yongqiang Liu 14 Sep '22

14 Sep '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v4.19.257 commit c3b1e88f14e7f442e2ddcbec94527eec84ac0ca3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PE9S CVE: CVE-2022-39188 -------------------------------- commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream. Some drivers rely on having all VMAs through which a PFN might be accessible listed in the rmap for correctness. However, on X86, it was possible for a VMA with stale TLB entries to not be listed in the rmap. This was fixed in mainline with commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"), but that commit relies on preceding refactoring in commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"). This patch provides equivalent protection without needing that refactoring, by forcing a TLB flush between removing PTEs in unmap_vmas() and the call to unlink_file_vma() in free_pgtables(). [This is a stable-specific rewrite of the upstream commit!] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: zuoze <zuoze1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/mmap.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index a2699bc10f7b..3bf113a24599 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2899,6 +2899,18 @@ static void unmap_region(struct mm_struct *mm, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); unmap_vmas(&tlb, vma, start, end); + + /* + * Ensure we have no stale TLB entries by the time this mapping is + * removed from the rmap. + * Note that we don't have to worry about nested flushes here because + * we're holding the mm semaphore for removing the mapping - so any + * concurrent flush in this region has to be coming through the rmap, + * and we synchronize against that using the rmap lock. + */ + if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) + tlb_flush_mmu(&tlb); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, start, end); -- 2.25.1

1 0

[PATCH openEuler-5.10] Script: Add shell script for adding openeuler patch header
by Zheng Zengkai 14 Sep '22

14 Sep '22

script for adding mainline patch header. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- add-openeuler-patch-header-mainline.sh | 56 ++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100755 add-openeuler-patch-header-mainline.sh diff --git a/add-openeuler-patch-header-mainline.sh b/add-openeuler-patch-header-mainline.sh new file mode 100755 index 000000000000..e9352911d242 --- /dev/null +++ b/add-openeuler-patch-header-mainline.sh @@ -0,0 +1,56 @@ +#!/bin/sh + +# +# Usage: +# +# prerequisite: +# +# The patches to add header should be patches from linux mainline. +# +# command (run in the directory where patch files stored): +# add-openeuler-patch-header-mainline.sh commit1..commit2 gitee_issue_url +# +# commit1: mainline start commit id +# commit2: mainline end commit id +# gitee_issue_url: for example: https://gitee.com/openeuler/kernel/issues/I4MKP4 +# +# Example: +# add-openeuler-patch-header-mainline.sh 2c85ebc57b3e..80e78fcce86d https://gitee.com/openeuler/kernel/issues/I5OHOB +# + +for p in `ls *.patch` +do + if [ $p == "0000-cover-letter.patch" ]; then + continue + fi + + title=$(sed '/^Subject: \[PATCH .*\]/{N;s/\n / /g}' $p | grep -E "^Subject: \[PATCH .*\]" | cut -d ']' -f 2) + commit=$(git log --pretty=oneline $1 | grep -F "$title" | cut -d ' ' -f 1) + if [ -n "$multi" ]; then + echo "$p" has multi-commits + commit="multi" + continue + fi + if [ -z "$commit" ]; then + echo "$p" commit is null + commit="null" + continue + fi + + # find insert line + i=5 + while true + do + ln=""$i"p" + sub=`cat $p | sed -n "$ln"` + i=$(($i+1)) + if [ -z "$sub" ]; then + break + fi + done + i=$(($i-1)) + + version=`git name-rev $commit | awk -F '[v~^]' '{print $2}'` + + sed ""$i"a mainline inclusion\nfrom mainline-v$version\ncommit $commit\ncategory: feature\nbugzilla: $2\nCVE: NA\n\n--------------------------------\n" -i $p +done -- 2.20.1

1 0

[PATCH openEuler-5.10-LTS 1/6] KVM: x86: do not report a vCPU as preempted outside instruction boundaries
by Zheng Zengkai 14 Sep '22

14 Sep '22

From: Paolo Bonzini <pbonzini(a)redhat.com> mainline inclusion from mainline-v5.19-rc2 commit 6cd88243c7e03845a450795e134b488fc2afb736 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PJ7H CVE: CVE-2022-39189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- If a vCPU is outside guest mode and is scheduled out, it might be in the process of making a memory access. A problem occurs if another vCPU uses the PV TLB flush feature during the period when the vCPU is scheduled out, and a virtual address has already been translated but has not yet been accessed, because this is equivalent to using a stale TLB entry. To avoid this, only report a vCPU as preempted if sure that the guest is at an instruction boundary. A rescheduling request will be delivered to the host physical CPU as an external interrupt, so for simplicity consider any vmexit *not* instruction boundary except for external interrupts. It would in principle be okay to report the vCPU as preempted also if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the vmentry/vmexit overhead unnecessarily, and optimistic spinning is also unlikely to succeed. However, leave it for later because right now kvm_vcpu_check_block() is doing memory accesses. Even though the TLB flush issue only applies to virtual memory address, it's very much preferrable to be conservative. Reported-by: Jann Horn <jannh(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> conflict: arch/x86/kvm/x86.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: yezengruan <yezengruan(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/x86/include/asm/kvm_host.h | 3 +++ arch/x86/kvm/svm/svm.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 1 + arch/x86/kvm/x86.c | 24 ++++++++++++++++++++++++ 4 files changed, 30 insertions(+) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index d90792da5b9e..01544554a4c2 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -551,6 +551,7 @@ struct kvm_vcpu_arch { u64 ia32_misc_enable_msr; u64 smbase; u64 smi_count; + bool at_instruction_boundary; bool tpr_access_reporting; bool xsaves_enabled; u64 ia32_xss; @@ -1072,6 +1073,8 @@ struct kvm_vcpu_stat { u64 utime; u64 stime; u64 gtime; + u64 preemption_reported; + u64 preemption_other; u64 preemption_timer_exits; }; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 2124fe54abfb..5231f40e8312 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3992,6 +3992,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu) { + if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR) + vcpu->arch.at_instruction_boundary = true; } static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 79889d27aa5b..96693ac066c2 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -6532,6 +6532,7 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu) return; handle_interrupt_nmi_irqoff(vcpu, gate_offset(desc)); + vcpu->arch.at_instruction_boundary = true; } static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 24c198e70f8e..dac43d92eb81 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -232,6 +232,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { VCPU_STAT("l1d_flush", l1d_flush), VCPU_STAT("halt_poll_success_ns", halt_poll_success_ns), VCPU_STAT("halt_poll_fail_ns", halt_poll_fail_ns), + VCPU_STAT("preemption_reported", preemption_reported), + VCPU_STAT("preemption_other", preemption_other), VM_STAT("mmu_shadow_zapped", mmu_shadow_zapped), VM_STAT("mmu_pte_write", mmu_pte_write), VM_STAT("mmu_pde_zapped", mmu_pde_zapped), @@ -286,6 +288,8 @@ struct dfx_kvm_stats_debugfs_item dfx_debugfs_entries[] = { DFX_STAT("stime", stime), DFX_STAT("gtime", gtime), DFX_STAT("preemption_timer_exits", preemption_timer_exits), + DFX_STAT("preemption_reported", preemption_reported), + DFX_STAT("preemption_other", preemption_other), { NULL } }; @@ -4078,6 +4082,19 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) struct kvm_host_map map; struct kvm_steal_time *st; + /* + * The vCPU can be marked preempted if and only if the VM-Exit was on + * an instruction boundary and will not trigger guest emulation of any + * kind (see vcpu_run). Vendor specific code controls (conservatively) + * when this is true, for example allowing the vCPU to be marked + * preempted if and only if the VM-Exit was due to a host interrupt. + */ + if (!vcpu->arch.at_instruction_boundary) { + vcpu->stat.preemption_other++; + return; + } + + vcpu->stat.preemption_reported++; if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) return; @@ -9306,6 +9323,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu) vcpu->arch.l1tf_flush_l1d = true; for (;;) { + /* + * If another guest vCPU requests a PV TLB flush in the middle + * of instruction emulation, the rest of the emulation could + * use a stale page translation. Assume that any code after + * this point can start executing an instruction. + */ + vcpu->arch.at_instruction_boundary = false; if (kvm_vcpu_running(vcpu)) { r = vcpu_enter_guest(vcpu); } else { -- 2.20.1

1 5

openEuler Kernel SIG例会
by openEuler conference 14 Sep '22

14 Sep '22

您好！ Kernel SIG 邀请您参加 2022-09-16 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.调度系列技术分享第三期 -- Linux调度器框架 2.openEuler开源之夏特性 -- 轻量级死锁检测实现 3.openEuler-22.09龙芯支持特性简介会议链接：https://us06web.zoom.us/j/87690719217?pwd=cDN6V3Bhc05DU3lqTmhHYzA2L0RBQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-09-16 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.调度系列技术分享第三期 -- Linux调度器框架 2.openEuler开源之夏特性 -- 轻量级死锁检测实现 3.openEuler-22.09龙芯支持特性简介 You can join the meeting at https://us06web.zoom.us/j/87690719217?pwd=cDN6V3Bhc05DU3lqTmhHYzA2L0RBQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
by Yongqiang Liu 14 Sep '22

14 Sep '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v5.19-rc4 commit a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PRMO CVE: CVE-2022-39842 --------------------- In pxa3xx_gcu_write, a count parameter of type size_t is passed to words of type int. Then, copy_from_user() may cause a heap overflow because it is used as the third argument of copy_from_user(). Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/pxa3xx-gcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c index 69cfb337c857..6fe5573e2008 100644 --- a/drivers/video/fbdev/pxa3xx-gcu.c +++ b/drivers/video/fbdev/pxa3xx-gcu.c @@ -394,7 +394,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff, struct pxa3xx_gcu_batch *buffer; struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file); - int words = count / 4; + size_t words = count / 4; /* Does not need to be atomic. There's a lock in user space, * but anyhow, this is just for statistics. */ -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 000/137] Patches for CVE-2022-29900, CVE-2022-23816
by Zheng Zengkai 14 Sep '22

14 Sep '22

Add patches for CVE-2022-29900, CVE-2022-23816 and CVE-2022-29901. Reference: https://lore.kernel.org/all/CAODzB9qH9WhxQ0eB+mNvmsn64bHXUVppuSTMDGJekYOPCw… https://www.amd.com/system/files/documents/technical-guidance-for-mitigatin… https://www.intel.com/content/www/us/en/developer/articles/technical/softwa… Alexandre Chartre (2): x86/bugs: Report AMD retbleed vulnerability x86/bugs: Add AMD retbleed= boot parameter Andrew Cooper (1): x86/cpu/amd: Enumerate BTC_NO Arnaldo Carvalho de Melo (5): tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers cpufeatures: Sync with the kernel sources tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' - again tools headers: Remove broken definition of __LITTLE_ENDIAN Ben Hutchings (3): x86: Add insn_decode_kernel() Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC} x86/xen: Fix initialisation in hypercall_page after rethunk Borislav Petkov (7): x86/insn: Rename insn_decode() to insn_decode_from_regs() x86/insn: Add a __ignore_sync_check__ marker x86/insn: Add an insn_decode() API x86/alternative: Use insn_decode() x86/alternative: Optimize single-byte NOPs at an arbitrary position kvm/emulate: Fix SETcc emulation function offsets with SLS tools/insn: Restore the relative include paths for cross building Greg Kroah-Hartman (1): x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted Joe Lawrence (1): objtool: Make .altinstructions section entry size consistent Josh Poimboeuf (24): objtool: Refactor ORC section generation objtool: Add 'alt_group' struct objtool: Support stack layout changes in alternatives objtool: Support retpoline jump detection for vmlinux.o objtool: Assume only ELF functions do sibling calls objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC x86/xen: Support objtool validation in xen-asm.S x86/xen: Support objtool vmlinux.o validation in xen-head.S objtool: Support asm jump tables objtool: Don't make .altinstructions writable objtool: Remove reloc symbol type checks in get_alt_entry() x86/bugs: Do IBPB fallback check only once x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Remove x86_spec_ctrl_mask objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} KVM: VMX: Flatten __vmx_vcpu_run() KVM: VMX: Convert launched argument to flags KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Fix IBRS handling after vmexit x86/speculation: Fill RSB on vmexit for IBRS x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub Juergen Gross (4): x86/alternative: Merge include files x86/alternative: Support not-feature x86/alternative: Support ALTERNATIVE_TERNARY x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() Kim Phillips (3): x86/sev: Avoid using __x86_return_thunk x86/bugs: Enable STIBP for JMP2RET x86/bugs: Remove apostrophe typo Konrad Rzeszutek Wilk (1): x86/kexec: Disable RET on kexec Lin Yujun (2): x86: Fix objtool build warning Re-add padlen to the structure alt_instr Linus Torvalds (2): objtool: print out the symbol type when complaining about it kvm: fix objtool relocation warning Nathan Chancellor (1): x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Pawan Gupta (3): x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/speculation: Disable RRSBA behavior Peter Zijlstra (69): x86/alternatives: Optimize optimize_nops() x86/retpoline: Simplify retpolines objtool: Correctly handle retpoline thunk calls objtool: Handle per arch retpoline naming objtool: Rework the elf_rebuild_reloc_section() logic objtool: Add elf_create_reloc() helper objtool: Create reloc sections implicitly objtool: Extract elf_strtab_concat() objtool: Extract elf_symbol_add() objtool: Add elf_create_undef_symbol() objtool: Keep track of retpoline call sites objtool: Cache instruction relocs objtool: Skip magical retpoline .altinstr_replacement objtool/x86: Rewrite retpoline thunk calls objtool: Fix .symtab_shndx handling for elf_create_undef_symbol() objtool: Only rewrite unconditional retpoline thunk calls objtool: Teach get_alt_entry() about more relocation types objtool: Introduce CFI hash objtool: Handle __sanitize_cov*() tail calls objtool: Classify symbols objtool: Explicitly avoid self modifying code in .altinstr_replacement objtool,x86: Replace alternatives with .retpoline_sites objtool/x86: Ignore __x86_indirect_alt_* symbols x86/asm: Fix register order x86/asm: Fixup odd GEN-for-each-reg.h usage x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h x86/retpoline: Create a retpoline thunk array x86/alternative: Implement .retpoline_sites support bpf,x86: Simplify computing label offsets bpf,x86: Respect X86_FEATURE_RETPOLINE* x86/lib/atomic64_386_32: Rename things x86: Prepare asm files for straight-line-speculation x86: Prepare inline-asm for straight-line-speculation x86/alternative: Relax text_poke_bp() constraint objtool: Add straight-line-speculation validation x86: Add straight-line-speculation mitigation objtool: Default ignore INT3 for unreachable crypto: x86/poly1305 - Fixup SLS objtool: Fix SLS validation for kcov tail-call replacement x86/entry: Remove skip_r11rcx x86/kvm/vmx: Make noinstr clean x86/cpufeatures: Move RETPOLINE flags to word 11 x86/retpoline: Cleanup some #ifdefery x86/retpoline: Swizzle retpoline thunk x86/retpoline: Use -mfunction-return x86: Undo return-thunk damage x86,objtool: Create .return_sites x86,static_call: Use alternative RET encoding x86/ftrace: Use alternative RET encoding x86/bpf: Use alternative RET encoding x86/kvm: Fix SETcc emulation for return thunks x86/vsyscall_emu/64: Don't use RET in vsyscall emulation x86: Use return-thunk in asm code objtool: Treat .text.__x86.* as noinstr x86: Add magic AMD return-thunk x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value x86/entry: Add kernel IBRS implementation x86/bugs: Optimize SPEC_CTRL MSR writes x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() x86/bugs: Report Intel retbleed vulnerability intel_idle: Disable IBRS during long idle objtool: Update Retpoline validation x86/xen: Rename SYS* entry points x86/bugs: Add retbleed=ibpb objtool: Add entry UNRET validation x86/cpu/amd: Add Spectral Chicken x86/common: Stamp out the stepping madness x86/retbleed: Add fine grained Kconfig knobs um: Add missing apply_returns() Thadeu Lima de Souza Cascardo (4): x86/realmode: build with -D__DISABLE_EXPORTS x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported efi/x86: use naked RET on mixed mode call wrapper x86/kvm: fix FASTOP_SIZE when return thunks are enabled Thomas Gleixner (1): x86/static_call: Serialize __static_call_fixup() properly Uros Bizjak (2): KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw Vasily Gorbik (1): objtool: Fix elf_create_undef_symbol() endianness .../admin-guide/kernel-parameters.txt | 25 + Makefile | 20 +- arch/um/kernel/um_arch.c | 8 + arch/x86/Kconfig | 91 +- arch/x86/Makefile | 8 +- arch/x86/boot/compressed/efi_thunk_64.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/boot/compressed/mem_encrypt.S | 4 +- arch/x86/crypto/aegis128-aesni-asm.S | 48 +- arch/x86/crypto/aes_ctrby8_avx-x86_64.S | 2 +- arch/x86/crypto/aesni-intel_asm.S | 52 +- arch/x86/crypto/aesni-intel_avx-x86_64.S | 40 +- arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 12 +- arch/x86/crypto/camellia-aesni-avx-asm_64.S | 18 +- arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 18 +- arch/x86/crypto/camellia-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/chacha-avx2-x86_64.S | 6 +- arch/x86/crypto/chacha-avx512vl-x86_64.S | 6 +- arch/x86/crypto/chacha-ssse3-x86_64.S | 8 +- arch/x86/crypto/crc32-pclmul_asm.S | 2 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +- arch/x86/crypto/crct10dif-pcl-asm_64.S | 2 +- arch/x86/crypto/des3_ede-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 6 +- arch/x86/crypto/nh-avx2-x86_64.S | 2 +- arch/x86/crypto/nh-sse2-x86_64.S | 2 +- arch/x86/crypto/poly1305-x86_64-cryptogams.pl | 38 +- arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/serpent-avx2-asm_64.S | 16 +- arch/x86/crypto/serpent-sse2-i586-asm_32.S | 6 +- arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 6 +- arch/x86/crypto/sha1_avx2_x86_64_asm.S | 2 +- arch/x86/crypto/sha1_ni_asm.S | 2 +- arch/x86/crypto/sha1_ssse3_asm.S | 2 +- arch/x86/crypto/sha256-avx-asm.S | 2 +- arch/x86/crypto/sha256-avx2-asm.S | 2 +- arch/x86/crypto/sha256-ssse3-asm.S | 2 +- arch/x86/crypto/sha256_ni_asm.S | 2 +- arch/x86/crypto/sha512-avx-asm.S | 2 +- arch/x86/crypto/sha512-avx2-asm.S | 2 +- arch/x86/crypto/sha512-ssse3-asm.S | 2 +- arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/twofish-i586-asm_32.S | 4 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 6 +- arch/x86/crypto/twofish-x86_64-asm_64.S | 4 +- arch/x86/entry/Makefile | 2 +- arch/x86/entry/calling.h | 72 +- arch/x86/entry/entry.S | 22 + arch/x86/entry/entry_32.S | 6 +- arch/x86/entry/entry_64.S | 62 +- arch/x86/entry/entry_64_compat.S | 21 +- arch/x86/entry/thunk_32.S | 2 +- arch/x86/entry/thunk_64.S | 2 +- arch/x86/entry/vdso/Makefile | 1 + arch/x86/entry/vdso/vdso32/system_call.S | 4 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 3 + arch/x86/include/asm/GEN-for-each-reg.h | 14 +- arch/x86/include/asm/alternative-asm.h | 114 -- arch/x86/include/asm/alternative.h | 133 +- arch/x86/include/asm/asm-prototypes.h | 17 - arch/x86/include/asm/cpufeature.h | 41 +- arch/x86/include/asm/cpufeatures.h | 12 +- arch/x86/include/asm/disabled-features.h | 21 +- arch/x86/include/asm/inat.h | 2 +- arch/x86/include/asm/insn-eval.h | 4 +- arch/x86/include/asm/insn.h | 28 +- arch/x86/include/asm/linkage.h | 22 + arch/x86/include/asm/msr-index.h | 13 + arch/x86/include/asm/nospec-branch.h | 148 ++- arch/x86/include/asm/paravirt.h | 2 +- arch/x86/include/asm/qspinlock_paravirt.h | 4 +- arch/x86/include/asm/smap.h | 5 +- arch/x86/include/asm/static_call.h | 19 +- arch/x86/include/asm/unwind_hints.h | 23 +- arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 356 +++++- arch/x86/kernel/cpu/amd.c | 46 +- arch/x86/kernel/cpu/bugs.c | 475 ++++++- arch/x86/kernel/cpu/common.c | 61 +- arch/x86/kernel/cpu/cpu.h | 2 + arch/x86/kernel/cpu/hygon.c | 6 + arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/ftrace.c | 7 +- arch/x86/kernel/ftrace_32.S | 6 +- arch/x86/kernel/ftrace_64.S | 13 +- arch/x86/kernel/head_32.S | 2 +- arch/x86/kernel/head_64.S | 5 + arch/x86/kernel/irqflags.S | 4 +- arch/x86/kernel/kprobes/core.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kernel/module.c | 15 +- arch/x86/kernel/paravirt.c | 2 +- arch/x86/kernel/process.c | 2 +- arch/x86/kernel/relocate_kernel_32.S | 15 +- arch/x86/kernel/relocate_kernel_64.S | 13 +- arch/x86/kernel/sev-es.c | 2 +- arch/x86/kernel/sev_verify_cbit.S | 2 +- arch/x86/kernel/static_call.c | 52 +- arch/x86/kernel/umip.c | 2 +- arch/x86/kernel/verify_cpu.S | 4 +- arch/x86/kernel/vmlinux.lds.S | 23 +- arch/x86/kvm/emulate.c | 39 +- arch/x86/kvm/svm/vmenter.S | 11 +- arch/x86/kvm/vmx/nested.c | 32 +- arch/x86/kvm/vmx/run_flags.h | 8 + arch/x86/kvm/vmx/vmenter.S | 170 +-- arch/x86/kvm/vmx/vmx.c | 78 +- arch/x86/kvm/vmx/vmx.h | 5 + arch/x86/kvm/x86.c | 4 +- arch/x86/lib/atomic64_386_32.S | 88 +- arch/x86/lib/atomic64_cx8_32.S | 18 +- arch/x86/lib/checksum_32.S | 8 +- arch/x86/lib/clear_page_64.S | 6 +- arch/x86/lib/cmpxchg16b_emu.S | 4 +- arch/x86/lib/cmpxchg8b_emu.S | 4 +- arch/x86/lib/copy_mc_64.S | 6 +- arch/x86/lib/copy_page_64.S | 10 +- arch/x86/lib/copy_user_64.S | 14 +- arch/x86/lib/csum-copy_64.S | 2 +- arch/x86/lib/error-inject.c | 3 +- arch/x86/lib/getuser.S | 22 +- arch/x86/lib/hweight.S | 6 +- arch/x86/lib/inat.c | 2 +- arch/x86/lib/insn-eval.c | 6 +- arch/x86/lib/insn.c | 222 +++- arch/x86/lib/iomap_copy_64.S | 2 +- arch/x86/lib/memcpy_64.S | 14 +- arch/x86/lib/memmove_64.S | 11 +- arch/x86/lib/memset_64.S | 8 +- arch/x86/lib/msr-reg.S | 4 +- arch/x86/lib/putuser.S | 6 +- arch/x86/lib/retpoline.S | 118 +- arch/x86/math-emu/div_Xsig.S | 2 +- arch/x86/math-emu/div_small.S | 2 +- arch/x86/math-emu/mul_Xsig.S | 6 +- arch/x86/math-emu/polynom_Xsig.S | 2 +- arch/x86/math-emu/reg_norm.S | 6 +- arch/x86/math-emu/reg_round.S | 2 +- arch/x86/math-emu/reg_u_add.S | 2 +- arch/x86/math-emu/reg_u_div.S | 2 +- arch/x86/math-emu/reg_u_mul.S | 2 +- arch/x86/math-emu/reg_u_sub.S | 2 +- arch/x86/math-emu/round_Xsig.S | 4 +- arch/x86/math-emu/shr_Xsig.S | 8 +- arch/x86/math-emu/wm_shrx.S | 16 +- arch/x86/mm/mem_encrypt_boot.S | 6 + arch/x86/net/bpf_jit_comp.c | 185 ++- arch/x86/net/bpf_jit_comp32.c | 22 +- arch/x86/platform/efi/efi_stub_32.S | 2 +- arch/x86/platform/efi/efi_stub_64.S | 2 +- arch/x86/platform/efi/efi_thunk_64.S | 5 +- arch/x86/platform/olpc/xo1-wakeup.S | 6 +- arch/x86/power/hibernate_asm_32.S | 4 +- arch/x86/power/hibernate_asm_64.S | 4 +- arch/x86/um/checksum_32.S | 4 +- arch/x86/um/setjmp_32.S | 2 +- arch/x86/um/setjmp_64.S | 2 +- arch/x86/xen/Makefile | 1 - arch/x86/xen/setup.c | 6 +- arch/x86/xen/xen-asm.S | 43 +- arch/x86/xen/xen-head.S | 6 +- arch/x86/xen/xen-ops.h | 6 +- drivers/base/cpu.c | 8 + drivers/idle/intel_idle.c | 43 +- include/linux/cpu.h | 2 + include/linux/kvm_host.h | 2 +- include/linux/objtool.h | 14 +- samples/ftrace/ftrace-direct-modify.c | 4 +- samples/ftrace/ftrace-direct-too.c | 2 +- samples/ftrace/ftrace-direct.c | 2 +- scripts/Makefile.build | 6 + scripts/link-vmlinux.sh | 6 + security/Kconfig | 11 - tools/arch/x86/include/asm/cpufeatures.h | 12 +- .../arch/x86/include/asm/disabled-features.h | 21 +- tools/arch/x86/include/asm/inat.h | 2 +- tools/arch/x86/include/asm/insn.h | 28 +- tools/arch/x86/include/asm/msr-index.h | 13 + tools/arch/x86/lib/inat.c | 2 +- tools/arch/x86/lib/insn.c | 222 +++- tools/arch/x86/lib/memcpy_64.S | 14 +- tools/arch/x86/lib/memset_64.S | 8 +- .../asm/{alternative-asm.h => alternative.h} | 0 tools/include/linux/kconfig.h | 67 + tools/include/linux/objtool.h | 14 +- .../Documentation/stack-validation.txt | 16 +- tools/objtool/Makefile | 4 - tools/objtool/arch.h | 13 +- tools/objtool/arch/x86/decode.c | 58 +- tools/objtool/builtin-check.c | 6 +- tools/objtool/builtin-orc.c | 6 +- tools/objtool/builtin.h | 3 +- tools/objtool/cfi.h | 2 + tools/objtool/check.c | 1131 +++++++++++++---- tools/objtool/check.h | 35 +- tools/objtool/elf.c | 230 ++-- tools/objtool/elf.h | 20 +- tools/objtool/objtool.c | 2 + tools/objtool/objtool.h | 5 +- tools/objtool/orc_gen.c | 324 ++--- tools/objtool/special.c | 22 +- tools/objtool/sync-check.sh | 17 +- tools/objtool/weak.c | 7 +- tools/perf/check-headers.sh | 15 +- 207 files changed, 4323 insertions(+), 1902 deletions(-) create mode 100644 arch/x86/entry/entry.S delete mode 100644 arch/x86/include/asm/alternative-asm.h create mode 100644 arch/x86/kvm/vmx/run_flags.h rename tools/include/asm/{alternative-asm.h => alternative.h} (100%) create mode 100644 tools/include/linux/kconfig.h -- 2.20.1

1 137

[PATCH openEuler-1.0-LTS] KVM: x86: do not report a vCPU as preempted outside instruction boundaries
by Yongqiang Liu 14 Sep '22

14 Sep '22

From: Paolo Bonzini <pbonzini(a)redhat.com> mainline inclusion from mainline-v5.19-rc2 commit 6cd88243c7e03845a450795e134b488fc2afb736 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PJ7H CVE: CVE-2022-39189 ---------------------------------------- If a vCPU is outside guest mode and is scheduled out, it might be in the process of making a memory access. A problem occurs if another vCPU uses the PV TLB flush feature during the period when the vCPU is scheduled out, and a virtual address has already been translated but has not yet been accessed, because this is equivalent to using a stale TLB entry. To avoid this, only report a vCPU as preempted if sure that the guest is at an instruction boundary. A rescheduling request will be delivered to the host physical CPU as an external interrupt, so for simplicity consider any vmexit *not* instruction boundary except for external interrupts. It would in principle be okay to report the vCPU as preempted also if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the vmentry/vmexit overhead unnecessarily, and optimistic spinning is also unlikely to succeed. However, leave it for later because right now kvm_vcpu_check_block() is doing memory accesses. Even though the TLB flush issue only applies to virtual memory address, it's very much preferrable to be conservative. Reported-by: Jann Horn <jannh(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> conflict: arch/x86/include/asm/kvm_host.h arch/x86/kvm/svm.c arch/x86/kvm/vmx.c arch/x86/kvm/x86.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/include/asm/kvm_host.h | 3 +++ arch/x86/kvm/svm.c | 3 +++ arch/x86/kvm/vmx.c | 1 + arch/x86/kvm/x86.c | 25 +++++++++++++++++++++++++ 4 files changed, 32 insertions(+) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 6549c20c958c..7afb2cb2d42c 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -520,6 +520,7 @@ struct kvm_vcpu_arch { u64 ia32_misc_enable_msr; u64 smbase; u64 smi_count; + bool at_instruction_boundary; bool tpr_access_reporting; u64 ia32_xss; u64 microcode_version; @@ -935,6 +936,8 @@ struct kvm_vcpu_stat { u64 utime; u64 stime; u64 gtime; + u64 preemption_reported; + u64 preemption_other; }; struct x86_instruction_info; diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 46567343680f..f611ecdfc145 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -6205,6 +6205,9 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, static void svm_handle_external_intr(struct kvm_vcpu *vcpu) { + if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR) + vcpu->arch.at_instruction_boundary = true; + local_irq_enable(); /* * We must have an instruction with interrupts enabled, so diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 7ab18b5a8e96..4164016cf105 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -10597,6 +10597,7 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu) [cs]"i"(__KERNEL_CS) ); } + vcpu->arch.at_instruction_boundary = true; } STACK_FRAME_NON_STANDARD(vmx_handle_external_intr); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 5da2811219ec..c61cab768d2a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -186,6 +186,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { { "halt_successful_poll", VCPU_STAT(halt_successful_poll) }, { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll) }, { "halt_poll_invalid", VCPU_STAT(halt_poll_invalid) }, + { "preemption_reported", VCPU_STAT(preemption_reported) }, + { "preemption_other", VCPU_STAT(preemption_other) }, { "halt_wakeup", VCPU_STAT(halt_wakeup) }, { "hypercalls", VCPU_STAT(hypercalls) }, { "request_irq", VCPU_STAT(request_irq_exits) }, @@ -231,6 +233,8 @@ struct dfx_kvm_stats_debugfs_item dfx_debugfs_entries[] = { DFX_STAT("halt_exits", halt_exits), DFX_STAT("halt_successful_poll", halt_successful_poll), DFX_STAT("halt_attempted_poll", halt_attempted_poll), + DFX_STAT("preemption_reported", preemption_reported), + DFX_STAT("preemption_other", preemption_other), DFX_STAT("halt_wakeup", halt_wakeup), DFX_STAT("request_irq", request_irq_exits), DFX_STAT("irq_exits", irq_exits), @@ -3314,6 +3318,20 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) { + /* + * The vCPU can be marked preempted if and only if the VM-Exit was on + * an instruction boundary and will not trigger guest emulation of any + * kind (see vcpu_run). Vendor specific code controls (conservatively) + * when this is true, for example allowing the vCPU to be marked + * preempted if and only if the VM-Exit was due to a host interrupt. + */ + if (!vcpu->arch.at_instruction_boundary) { + vcpu->stat.preemption_other++; + return; + } + + vcpu->stat.preemption_reported++; + if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) return; @@ -7920,6 +7938,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu) vcpu->arch.l1tf_flush_l1d = true; for (;;) { + /* + * If another guest vCPU requests a PV TLB flush in the middle + * of instruction emulation, the rest of the emulation could + * use a stale page translation. Assume that any code after + * this point can start executing an instruction. + */ + vcpu->arch.at_instruction_boundary = false; if (kvm_vcpu_running(vcpu)) { r = vcpu_enter_guest(vcpu); } else { -- 2.25.1

1 0

[PATCH] KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE
by Laibin Qiu 14 Sep '22

14 Sep '22

From: Andrew Murray <andrew.murray(a)arm.com> mainline inclusion from mainline-v5.6 commit 4942dc6638b07b5326b6d2faa142635c559e7cd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QR6C CVE: NA ------------- On VHE systems arch.mdcr_el2 is written to mdcr_el2 at vcpu_load time to set options for self-hosted debug and the performance monitors extension. Unfortunately the value of arch.mdcr_el2 is not calculated until kvm_arm_setup_debug() in the run loop after the vcpu has been loaded. This means that the initial brief iterations of the run loop use a zero value of mdcr_el2 - until the vcpu is preempted. This also results in a delay between changes to vcpu->guest_debug taking effect. Fix this by writing to mdcr_el2 in kvm_arm_setup_debug() on VHE systems when a change to arch.mdcr_el2 has been detected. Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions") Cc: <stable(a)vger.kernel.org> # 4.17.x- Suggested-by: James Morse <james.morse(a)arm.com> Acked-by: Will Deacon <will(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Andrew Murray <andrew.murray(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Zengruan Ye <yezengruan(a)huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm64/kvm/debug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c index 00d422336a45..4e722d73a3c3 100644 --- a/arch/arm64/kvm/debug.c +++ b/arch/arm64/kvm/debug.c @@ -112,7 +112,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) { bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY); - unsigned long mdscr; + unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2; trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug); @@ -208,6 +208,10 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE)) vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY; + /* Write mdcr_el2 changes since vcpu_load on VHE systems */ + if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2) + write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2); + trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2); trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1)); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] perf bench futex-wake: Restore thread count default to online CPU count
by tangbin 13 Sep '22

13 Sep '22

From: Tommi Rantala <tommi.t.rantala(a)nokia.com> stable inclusion from stable-v4.19.111 commit 5e8dff99645e574122aef5dec91b8803339a6362 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QSAP CVE: NA -------------------------------- commit f649bd9dd5d5004543bbc3c50b829577b49f5d75 upstream. Since commit 3b2323c2c1c4 ("perf bench futex: Use cpumaps") the default number of threads the benchmark uses got changed from number of online CPUs to zero: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 15930]: blocking on 0 threads (at [private] futex 0x558b8ee4bfac), waking up 1 at a time. [Run 1]: Wokeup 0 of 0 threads in 0.0000 ms [...] [Run 10]: Wokeup 0 of 0 threads in 0.0000 ms Wokeup 0 of 0 threads in 0.0004 ms (+-40.82%) Restore the old behavior by grabbing the number of online CPUs via cpu->nr: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 18356]: blocking on 8 threads (at [private] futex 0xb3e62c), waking up 1 at a time. [Run 1]: Wokeup 8 of 8 threads in 0.0260 ms [...] [Run 10]: Wokeup 8 of 8 threads in 0.0270 ms Wokeup 8 of 8 threads in 0.0419 ms (+-24.35%) Fixes: 3b2323c2c1c4 ("perf bench futex: Use cpumaps") Signed-off-by: Tommi Rantala <tommi.t.rantala(a)nokia.com> Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Darren Hart <dvhart(a)infradead.org> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Link: http://lore.kernel.org/lkml/20200305083714.9381-3-tommi.t.rantala@nokia.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- tools/perf/bench/futex-wake.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c index e8181ad7d088..e62006342b18 100644 --- a/tools/perf/bench/futex-wake.c +++ b/tools/perf/bench/futex-wake.c @@ -42,7 +42,7 @@ static bool done = false, silent = false, fshared = false; static pthread_mutex_t thread_lock; static pthread_cond_t thread_parent, thread_worker; static struct stats waketime_stats, wakeup_stats; -static unsigned int ncpus, threads_starting, nthreads = 0; +static unsigned int threads_starting, nthreads = 0; static int futex_flag = 0; static const struct option options[] = { @@ -140,7 +140,7 @@ int bench_futex_wake(int argc, const char **argv) sigaction(SIGINT, &act, NULL); if (!nthreads) - nthreads = ncpus; + nthreads = cpu->nr; worker = calloc(nthreads, sizeof(*worker)); if (!worker) -- 2.18.4

1 0

[PATCH openEuler-1.0-LTS] netfilter: nf_conntrack_irc: Tighten matching on DCC message
by Yongqiang Liu 13 Sep '22

13 Sep '22

From: David Leadbeater <dgl(a)dgl.cx> mainline inclusion from mainline-v6.0-rc6 commit e8d5dfd1d8747b56077d02664a8838c71ced948e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5OWZ7 CVE: CVE-2022-2663 --------------------------- CTCP messages should only be at the start of an IRC message, not anywhere within it. While the helper only decodes packes in the ORIGINAL direction, its possible to make a client send a CTCP message back by empedding one into a PING request. As-is, thats enough to make the helper believe that it saw a CTCP message. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") Signed-off-by: David Leadbeater <dgl(a)dgl.cx> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c index 4099f4d79bae..819fc0df233f 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -150,15 +150,37 @@ static int help(struct sk_buff *skb, unsigned int protoff, data = ib_ptr; data_limit = ib_ptr + skb->len - dataoff; - /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24 - * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ - while (data < data_limit - (19 + MINMATCHLEN)) { - if (memcmp(data, "\1DCC ", 5)) { + /* Skip any whitespace */ + while (data < data_limit - 10) { + if (*data == ' ' || *data == '\r' || *data == '\n') + data++; + else + break; + } + + /* strlen("PRIVMSG x ")=10 */ + if (data < data_limit - 10) { + if (strncasecmp("PRIVMSG ", data, 8)) + goto out; + data += 8; + } + + /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26 + * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26 + */ + while (data < data_limit - (21 + MINMATCHLEN)) { + /* Find first " :", the start of message */ + if (memcmp(data, " :", 2)) { data++; continue; } + data += 2; + + /* then check that place only for the DCC command */ + if (memcmp(data, "\1DCC ", 5)) + goto out; data += 5; - /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */ + /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */ iph = ip_hdr(skb); pr_debug("DCC found in master %pI4:%u %pI4:%u\n", @@ -174,7 +196,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, pr_debug("DCC %s detected\n", dccprotos[i]); /* we have at least - * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid + * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid * data left (== 14/13 bytes) */ if (parse_dcc(data, data_limit, &dcc_ip, &dcc_port, &addr_beg_p, &addr_end_p)) { -- 2.25.1

1 0