December 2023 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v2 0/2] KABI reservation for IMA and crypto
by GUO Zihua 29 Dec '23

29 Dec '23

KABI reservation for IMA and crypto module. v2: Changed reservation ordering, and more reservation. GUO Zihua (2): crypto: kabi: KABI reservation for crypto ima: kabi: KABI reservation for IMA include/crypto/aead.h | 4 ++++ include/crypto/akcipher.h | 4 ++++ include/crypto/algapi.h | 4 ++++ include/crypto/cryptd.h | 2 ++ include/crypto/hash.h | 5 +++++ include/crypto/if_alg.h | 6 ++++++ include/crypto/public_key.h | 3 +++ include/crypto/rng.h | 3 +++ include/crypto/skcipher.h | 4 ++++ include/linux/crypto.h | 3 +++ include/linux/fs.h | 2 ++ include/linux/kernel_read_file.h | 3 +++ include/linux/kexec.h | 5 +++++ include/linux/user_namespace.h | 3 +++ 14 files changed, 51 insertions(+) -- 2.34.1

2 3

会议提醒//openEuler Kernel SIG双周例会
by liaotao (C) 29 Dec '23

29 Dec '23

2023-12-29 14:00 【openEuler Kernel SIG双周例会】会议内容：议题一：进展update（张伽琳 & 章昌仲）议题二：新增树莓派dev分包议题三：内核态vDPA支持热迁移特性回合SP1/SP2影响评审期待您的参加，欢迎您在以下地址【申报议题】：https://etherpad.openeuler.org/p/Kernel-meetings -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年12月27日 14:08 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年12月29日星期五 14:00-15:45(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-12-29 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/986451425 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference(auto recording) will be held at 2023-12-29 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/986451425. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10] net/rose: Fix Use-After-Free in rose_ioctl
by Lu Wei 29 Dec '23

29 Dec '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.7-rc6 commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8RXMW CVE: CVE-2023-51782 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Because rose_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with rose_accept(). A use-after-free for skb occurs with the following flow. ``` rose_ioctl() -> skb_peek() rose_accept() -> skb_dequeue() -> kfree_skb() ``` Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/rose/af_rose.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c index 86c93cf1744b..b3e7a92f1ec1 100644 --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -1307,9 +1307,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) case TIOCINQ: { struct sk_buff *skb; long amount = 0L; - /* These two are safe on a single CPU system as only user tasks fiddle here */ + + spin_lock_irq(&sk->sk_receive_queue.lock); if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) amount = skb->len; + spin_unlock_irq(&sk->sk_receive_queue.lock); return put_user(amount, (unsigned int __user *) argp); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net/rose: Fix Use-After-Free in rose_ioctl
by Lu Wei 29 Dec '23

29 Dec '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.7-rc6 commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8RXMW CVE: CVE-2023-51782 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Because rose_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with rose_accept(). A use-after-free for skb occurs with the following flow. ``` rose_ioctl() -> skb_peek() rose_accept() -> skb_dequeue() -> kfree_skb() ``` Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/rose/af_rose.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c index d00a0ef39a56..6d3a0ed14706 100644 --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -1293,9 +1293,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) case TIOCINQ: { struct sk_buff *skb; long amount = 0L; - /* These two are safe on a single CPU system as only user tasks fiddle here */ + + spin_lock_irq(&sk->sk_receive_queue.lock); if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) amount = skb->len; + spin_unlock_irq(&sk->sk_receive_queue.lock); return put_user(amount, (unsigned int __user *) argp); } -- 2.34.1

2 1

[PATCH OLK-6.6] atm: Fix Use-After-Free in do_vcc_ioctl
by Zhengchao Shao 29 Dec '23

29 Dec '23

From: Hyunwoo Kim <v4bel(a)theori.io> stable inclusion from stable-v6.6.8 commit 531fd46f92895bcdc41bedd12533266c397196da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8RXNR CVE: CVE-2023-51780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 ] Because do_vcc_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with vcc_recvmsg(). A use-after-free for skb occurs with the following flow. ``` do_vcc_ioctl() -> skb_peek() vcc_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() ``` Add sk->sk_receive_queue.lock to do_vcc_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Link: https://lore.kernel.org/r/20231209094210.GA403126@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/atm/ioctl.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index 838ebf0cabbf..f81f8d56f5c0 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -73,14 +73,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, case SIOCINQ: { struct sk_buff *skb; + int amount; if (sock->state != SS_CONNECTED) { error = -EINVAL; goto done; } + spin_lock_irq(&sk->sk_receive_queue.lock); skb = skb_peek(&sk->sk_receive_queue); - error = put_user(skb ? skb->len : 0, - (int __user *)argp) ? -EFAULT : 0; + amount = skb ? skb->len : 0; + spin_unlock_irq(&sk->sk_receive_queue.lock); + error = put_user(amount, (int __user *)argp) ? -EFAULT : 0; goto done; } case ATM_SETSC: -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Fix 2 CVEs of CIFS of 5.10
by ZhaoLong Wang 28 Dec '23

28 Dec '23

Fixes: CVE-2023-6606 CVE-2023-6610 Paulo Alcantara (2): smb: client: fix OOB in smbCalcSize() smb: client: fix potential OOB in smb2_dump_detail() fs/cifs/misc.c | 4 ++++ fs/cifs/smb2misc.c | 30 +++++++++++++++--------------- fs/cifs/smb2ops.c | 6 ++++-- 3 files changed, 23 insertions(+), 17 deletions(-) -- 2.34.3

2 3

[PATCH OLK-6.6] arm64: seccomp: fix compilation error with ILP32 support
by Yi Yang 28 Dec '23

28 Dec '23

From: "GONG, Ruiqi" <gongruiqi1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8S6IA ------------------------------------------------- When ILP32 support is enabled, compilation on ARM64 would complain about an undeclared __NR_compat_syscalls, since commit 0b18db62881c ("arm64: ilp32: introduce syscall table for ILP32") changes the config that __NR_compat_syscalls depends on. Modify the config for SECCOMP_ARCH_COMPAT_NR accordingly. Fixes: ffde703470b0 ("arm64: Enable seccomp architecture tracking") Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- arch/arm64/include/asm/seccomp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/seccomp.h b/arch/arm64/include/asm/seccomp.h index a6be48b9225a..bc3ab2468f03 100644 --- a/arch/arm64/include/asm/seccomp.h +++ b/arch/arm64/include/asm/seccomp.h @@ -52,10 +52,10 @@ static inline const int *get_compat_mode1_syscalls(void) #define SECCOMP_ARCH_NATIVE AUDIT_ARCH_AARCH64 #define SECCOMP_ARCH_NATIVE_NR NR_syscalls #define SECCOMP_ARCH_NATIVE_NAME "aarch64" -#ifdef CONFIG_COMPAT +#ifdef CONFIG_AARCH32_EL0 # define SECCOMP_ARCH_COMPAT AUDIT_ARCH_ARM # define SECCOMP_ARCH_COMPAT_NR __NR_compat_syscalls # define SECCOMP_ARCH_COMPAT_NAME "arm" -#endif +#endif /* CONFIG_AARCH32_EL0 */ #endif /* _ASM_SECCOMP_H */ -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Fix 2 CVEs of CIFS of OLK-6.6
by ZhaoLong Wang 28 Dec '23

28 Dec '23

Fixes: CVE-2023-6606 CVE-2023-6610 Paulo Alcantara (2): smb: client: fix OOB in smbCalcSize() smb: client: fix potential OOB in smb2_dump_detail() fs/smb/client/misc.c | 4 ++++ fs/smb/client/smb2misc.c | 30 +++++++++++++++--------------- fs/smb/client/smb2ops.c | 6 ++++-- 3 files changed, 23 insertions(+), 17 deletions(-) -- 2.34.3

2 3

[PATCH openEuler-1.0-LTS 0/2] fix 2 CVEs of CIFS
by ZhaoLong Wang 28 Dec '23

28 Dec '23

Fixes: CVE-2023-6606 CVE-2023-6610 Paulo Alcantara (2): smb: client: fix OOB in smbCalcSize() smb: client: fix potential OOB in smb2_dump_detail() fs/cifs/misc.c | 4 ++++ fs/cifs/smb2misc.c | 30 +++++++++++++++--------------- fs/cifs/smb2ops.c | 6 ++++-- 3 files changed, 23 insertions(+), 17 deletions(-) -- 2.34.3

2 3

[PATCH openEuler-1.0-LTS] atm: Fix Use-After-Free in do_vcc_ioctl
by Zhengchao Shao 28 Dec '23

28 Dec '23

From: Hyunwoo Kim <v4bel(a)theori.io> stable inclusion from stable-v4.19.303 commit bff7ddb0d9d515170dcf133d239dba87c47c8cdb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8RXNR CVE: CVE-2023-51780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 ] Because do_vcc_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with vcc_recvmsg(). A use-after-free for skb occurs with the following flow. ``` do_vcc_ioctl() -> skb_peek() vcc_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() ``` Add sk->sk_receive_queue.lock to do_vcc_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Link: https://lore.kernel.org/r/20231209094210.GA403126@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/atm/ioctl.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index 2ff0e5e470e3..38f7f164e484 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -71,14 +71,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, case SIOCINQ: { struct sk_buff *skb; + int amount; if (sock->state != SS_CONNECTED) { error = -EINVAL; goto done; } + spin_lock_irq(&sk->sk_receive_queue.lock); skb = skb_peek(&sk->sk_receive_queue); - error = put_user(skb ? skb->len : 0, - (int __user *)argp) ? -EFAULT : 0; + amount = skb ? skb->len : 0; + spin_unlock_irq(&sk->sk_receive_queue.lock); + error = put_user(amount, (int __user *)argp) ? -EFAULT : 0; goto done; } case SIOCGSTAMP: /* borrowed from IP */ -- 2.34.1

2 1