January 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/9] Backport etmem feature to OLK 6.6
by Yuchen Tang 18 Jan '24

18 Jan '24

v4 -> v5 - fix redundant kvm config check v3 -> v4 - backport only core etmem feature - modify kernel swap enabled toggle implementation v2 -> v3 - fix code style and commit messages v1 -> v2 - make independent patches to export symbols we need - make independent patches for etmem scan and swap config - fix indentation and code style problems Yuchen Tang (9): etmem: add ETMEM feature CONFIG to mm/Kconfig etmem: add ETMEM scan feature CONFIG to mm/Kconfig mm: Export symbol __pud_trans_huge_lock mm: Export symbol walk_page_range etmem: add etmem scan feature mm: Export symbol reclaim_pages etmem: add etmem swap feature etmem: add original kernel swap enabled options etmem: enable etmem configurations arch/arm64/configs/openeuler_defconfig | 3 + arch/x86/configs/openeuler_defconfig | 3 + fs/proc/Makefile | 3 + fs/proc/base.c | 8 + fs/proc/etmem_proc.c | 216 ++++ fs/proc/etmem_scan.c | 1383 ++++++++++++++++++++++++ fs/proc/etmem_scan.h | 149 +++ fs/proc/etmem_swap.c | 109 ++ fs/proc/internal.h | 4 + include/linux/etmem.h | 47 + include/linux/mm.h | 4 + include/linux/mm_types.h | 4 + include/linux/swap.h | 1 + include/uapi/asm-generic/mman-common.h | 4 + mm/Kconfig | 33 + mm/Makefile | 1 + mm/etmem.c | 95 ++ mm/huge_memory.c | 1 + mm/internal.h | 1 - mm/madvise.c | 16 + mm/pagewalk.c | 1 + mm/swap_state.c | 4 + mm/vmscan.c | 8 + virt/kvm/kvm_main.c | 8 + 24 files changed, 2105 insertions(+), 1 deletion(-) create mode 100644 fs/proc/etmem_proc.c create mode 100644 fs/proc/etmem_scan.c create mode 100644 fs/proc/etmem_scan.h create mode 100644 fs/proc/etmem_swap.c create mode 100644 include/linux/etmem.h create mode 100644 mm/etmem.c -- 2.33.0

2 10

[PATCH OLK-5.10] tipc: fix a potential deadlock on &tx->lock
by Zhengchao Shao 18 Jan '24

18 Jan '24

From: Chengfeng Ye <dg573847474(a)gmail.com> stable inclusion from stable-v5.10.198 commit 6a24d0661fa389c241d935da38e0f6a5ee8eb1ae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WZL1 CVE: CVE-2024-0641 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 08e50cf071847323414df0835109b6f3560d44f5 ] It seems that tipc_crypto_key_revoke() could be be invoked by wokequeue tipc_crypto_work_rx() under process context and timer/rx callback under softirq context, thus the lock acquisition on &tx->lock seems better use spin_lock_bh() to prevent possible deadlock. This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock. tipc_crypto_work_rx() <workqueue> --> tipc_crypto_key_distr() --> tipc_bcast_xmit() --> tipc_bcbase_xmit() --> tipc_bearer_bc_xmit() --> tipc_crypto_xmit() --> tipc_ehdr_build() --> tipc_crypto_key_revoke() --> spin_lock(&tx->lock) <timer interrupt> --> tipc_disc_timeout() --> tipc_bearer_xmit_skb() --> tipc_crypto_xmit() --> tipc_ehdr_build() --> tipc_crypto_key_revoke() --> spin_lock(&tx->lock) <deadlock here> Signed-off-by: Chengfeng Ye <dg573847474(a)gmail.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Acked-by: Jon Maloy <jmaloy(a)redhat.com> Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Link: https://lore.kernel.org/r/20230927181414.59928-1-dg573847474@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/tipc/crypto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index de63d6d41645..7d26d0cb207a 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -1445,14 +1445,14 @@ static int tipc_crypto_key_revoke(struct net *net, u8 tx_key) struct tipc_crypto *tx = tipc_net(net)->crypto_tx; struct tipc_key key; - spin_lock(&tx->lock); + spin_lock_bh(&tx->lock); key = tx->key; WARN_ON(!key.active || tx_key != key.active); /* Free the active key */ tipc_crypto_key_set_state(tx, key.passive, 0, key.pending); tipc_crypto_key_detach(tx->aead[key.active], &tx->lock); - spin_unlock(&tx->lock); + spin_unlock_bh(&tx->lock); pr_warn("%s: key is revoked\n", tx->name); return -EKEYREVOKED; -- 2.34.1

2 1

[PATCH OLK-6.6 v2] mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task()
by Jinjiang Tu 18 Jan '24

18 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8WVL2 CVE: NA -------------------------------- When memcg oom occurs, commit be8d95530886 ("memcg: support priority for oom") calls memcg_print_bad_task() to print oc->chosen when the chosen task comes from low-priority memcg. oc->chosen may be assigned with -1 in oom_evaluate_task(). Howerver, memcg_print_bad_task() does't check if oc->chosen is -1 and leads to NULL pointer dereference. To fix it, check if oc->chosen is -1 in memcg_print_bad_task(). Fixes: be8d95530886 ("memcg: support priority for oom") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7ab0eec942ba..8327cef9d53a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4219,7 +4219,7 @@ void memcg_print_bad_task(struct oom_control *oc) if (memcg_oom_prio_disabled()) return; - if (oc->chosen) { + if (oc->chosen && oc->chosen != (void *)-1UL) { struct mem_cgroup *memcg; rcu_read_lock(); -- 2.25.1

2 1

[OLK-5.10 0/3] x86/quirks: Add parameter to clear MSIs early on boot
by Zheng Zengkai 18 Jan '24

18 Jan '24

A crash kernel boot failure issue is reported in openeuler 5.10 series kernel(in x86 virtual machine with Hi1822 virtual nic). Finally the issue was narrowed down to irq vector conflict. Backport following patchset from kernel maillist to fix this issue. https://lore.kernel.org/linux-pci/20181018183721.27467-3-gpiccoli@canonical… Guilherme G. Piccoli (3): x86/quirks: Scan all busses for early PCI quirks x86/PCI: Export find_cap() to be used in early PCI code x86/quirks: Add parameter to clear MSIs early on boot .../admin-guide/kernel-parameters.txt | 6 +++ arch/x86/include/asm/pci-direct.h | 2 + arch/x86/kernel/aperture_64.c | 30 +------------ arch/x86/kernel/early-quirks.c | 45 ++++++++++++++++--- arch/x86/pci/common.c | 4 ++ arch/x86/pci/early.c | 25 +++++++++++ 6 files changed, 77 insertions(+), 35 deletions(-) -- 2.20.1

1 3

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2022-48619
by Liao Chen 18 Jan '24

18 Jan '24

fix CVE-2022-48619 Jeff LaBundy (1): Input: add bounds checking to input_set_capability() drivers/input/input.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.8 commit 534733397da26de0303057ce0b93a22bda150365 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 upstream. Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/smb/client/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 386b62d5c133..ea7ccaea711a 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4937,6 +4937,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -4965,14 +4966,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -4996,8 +4998,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc6 commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/smb2ops.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 4f6cc104fdb5..eba4bdfff08a 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -3185,6 +3185,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_sync_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -3213,14 +3214,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_sync_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -3244,8 +3246,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1

[PATCH OLK-5.10] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc6 commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/smb2ops.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index b86f559751fd..caee4dedd7dc 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -4886,6 +4886,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_sync_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -4914,14 +4915,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_sync_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -4945,8 +4947,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1

[PATCH OLK-6.6] mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task()
by Jinjiang Tu 18 Jan '24

18 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8WVL2 CVE: NA -------------------------------- In OLK-5.10, when oc->chosen is assigned with -1 in oom_evaluate_task(), mem_cgroup_scan_tasks() will return -1, and only calls memcg_print_bad_task() when the return value is 0. commit 025b7799b35d ("mm/memcg: remove return value of mem_cgroup_scan_tasks()") removes return value of mem_cgroup_scan_tasks(). When adapting memcg oom priority feature to OLK-6.6, memcg_print_bad_task() will be called in all cases, and forgets to check if oc->chosen is -1, leading to NULL pointer dereference. Fixes: be8d95530886 ("memcg: support priority for oom") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7ab0eec942ba..8327cef9d53a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4219,7 +4219,7 @@ void memcg_print_bad_task(struct oom_control *oc) if (memcg_oom_prio_disabled()) return; - if (oc->chosen) { + if (oc->chosen && oc->chosen != (void *)-1UL) { struct mem_cgroup *memcg; rcu_read_lock(); -- 2.25.1

2 1

[PATCH] mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task()
by Jinjiang Tu 18 Jan '24

18 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8WVL2 CVE: NA -------------------------------- In OLK-5.10, when oc->chosen is assigned with -1 in oom_evaluate_task(), mem_cgroup_scan_tasks() will return -1, and only calls memcg_print_bad_task() when the return value is 0. commit 025b7799b35d ("mm/memcg: remove return value of mem_cgroup_scan_tasks()") removes return value of mem_cgroup_scan_tasks(). When adapting memcg oom priority feature to OLK-6.6, memcg_print_bad_task() will be called in all cases, and forgets to check if oc->chosen is -1, leading to NULL pointer dereference. Fixes: be8d95530886 ("memcg: support priority for oom") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7ab0eec942ba..8327cef9d53a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4219,7 +4219,7 @@ void memcg_print_bad_task(struct oom_control *oc) if (memcg_oom_prio_disabled()) return; - if (oc->chosen) { + if (oc->chosen && oc->chosen != (void *)-1UL) { struct mem_cgroup *memcg; rcu_read_lock(); -- 2.25.1

1 0