February 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] netfilter: nf_tables: reject QUEUE/DROP verdict parameters
by Dong Chenchen 04 Feb '24

04 Feb '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.8-rc2 commit f342de4e2f33e0e39165d8639387aa6c19dff660 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I90B2K CVE: CVE-2024-1086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This reverts commit e0abdadcc6e1. core.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP verdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar, or 0. Due to the reverted commit, its possible to provide a positive value, e.g. NF_ACCEPT (1), which results in use-after-free. Its not clear to me why this commit was made. NF_QUEUE is not used by nftables; "queue" rules in nftables will result in use of "nft_queue" expression. If we later need to allow specifiying errno values from userspace (do not know why), this has to call NF_DROP_GETERR and check that "err <= 0" holds true. Fixes: e0abdadcc6e1 ("netfilter: nf_tables: accept QUEUE/DROP verdict parameters") Cc: stable(a)vger.kernel.org Reported-by: Notselwyn <notselwyn(a)pwning.tech> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 208b77e374e4..5a74f9aec291 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -8972,16 +8972,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); switch (data->verdict.code) { - default: - switch (data->verdict.code & NF_VERDICT_MASK) { - case NF_ACCEPT: - case NF_DROP: - case NF_QUEUE: - break; - default: - return -EINVAL; - } - fallthrough; + case NF_ACCEPT: + case NF_DROP: + case NF_QUEUE: + break; case NFT_CONTINUE: case NFT_BREAK: case NFT_RETURN: @@ -9015,6 +9009,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, chain->use++; data->verdict.chain = chain; break; + default: + return -EINVAL; } desc->len = sizeof(data->verdict); -- 2.25.1

2 1

[PATCH OLK-6.6] block: kabi: KABI reservation for blk-cgroup
by Li Nan 04 Feb '24

04 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9110C ---------------------------------------------------------------------- Reserve KABI for file blk-cgroup.h. Signed-off-by: Li Nan <linan122(a)huawei.com> --- block/blk-cgroup.h | 36 ++++++++++++++++++++++++++++++++++++ include/linux/blkdev.h | 2 +- 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h index a2eb8be26f45..3ffad00fdb86 100644 --- a/block/blk-cgroup.h +++ b/block/blk-cgroup.h @@ -33,6 +33,7 @@ enum blkg_iostat_type { BLKG_IOSTAT_READ, BLKG_IOSTAT_WRITE, BLKG_IOSTAT_DISCARD, + BLKG_IOSTAT_KABI_REVERSE, BLKG_IOSTAT_NR, }; @@ -49,6 +50,12 @@ struct blkg_iostat_set { int lqueued; /* queued in llist */ struct blkg_iostat cur; struct blkg_iostat last; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) }; /* association between a blk cgroup and a request queue */ @@ -88,6 +95,15 @@ struct blkcg_gq { int last_use; struct rcu_head rcu_head; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct blkcg { @@ -117,6 +133,15 @@ struct blkcg { #ifdef CONFIG_CGROUP_V1_WRITEBACK struct list_head memcg_list; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; static inline struct blkcg *css_to_blkcg(struct cgroup_subsys_state *css) @@ -140,6 +165,9 @@ struct blkg_policy_data { struct blkcg_gq *blkg; int plid; bool online; + + KABI_RESERVE(1) + KABI_RESERVE(2) }; /* @@ -153,6 +181,9 @@ struct blkcg_policy_data { /* the blkcg and policy id this per-policy data belongs to */ struct blkcg *blkcg; int plid; + + KABI_RESERVE(1) + KABI_RESERVE(2) }; typedef struct blkcg_policy_data *(blkcg_pol_alloc_cpd_fn)(gfp_t gfp); @@ -186,6 +217,11 @@ struct blkcg_policy { blkcg_pol_free_pd_fn *pd_free_fn; blkcg_pol_reset_pd_stats_fn *pd_reset_stats_fn; blkcg_pol_stat_pd_fn *pd_stat_fn; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; extern struct blkcg blkcg_root; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index d8a0ee46ba37..7478cf6c6d63 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -48,7 +48,7 @@ extern struct class block_class; * Maximum number of blkcg policies allowed to be registered concurrently. * Defined here to simplify include dependency. */ -#define BLKCG_MAX_POLS 6 +#define BLKCG_MAX_POLS 10 #define DISK_MAX_PARTS 256 #define DISK_NAME_LEN 32 -- 2.39.2

2 1

[PATCH v2 OLK-6.6 0/4] Introduce page eject for arm64
by Wupeng Ma 04 Feb '24

04 Feb '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Page ejection is achieved by soft_offline_page and unpoison_memory. A linked list is maintained to log the pfns which are offlined by this module. Only the pfns present in the list is allowed to go online. The follow sysfs is introduced to online/offline page via this module, since there is a internal linked list to record all offlined pages, remove_page is introduce to remove this page from list. - /sys/kernel/page_eject/online_page - /sys/kernel/page_eject/offline_page - /sys/kernel/page_eject/remove_page Changelog since v1: - move page_eject.c to drivers/ras/hisilicon Ma Wupeng (4): mm/hwpoison: Export symbol soft_offline_page mm/memory-failure: introduce soft_online_page mm: page_eject: Introuduce page ejection config: update defconfig for PAGE_EJECT arch/arm64/configs/openeuler_defconfig | 1 + drivers/ras/Kconfig | 1 + drivers/ras/Makefile | 2 + drivers/ras/hisilicon/Kconfig | 10 + drivers/ras/hisilicon/Makefile | 2 + drivers/ras/hisilicon/page_eject.c | 249 +++++++++++++++++++++++++ include/linux/mm.h | 1 + mm/memory-failure.c | 55 ++++-- 8 files changed, 307 insertions(+), 14 deletions(-) create mode 100644 drivers/ras/hisilicon/Kconfig create mode 100644 drivers/ras/hisilicon/Makefile create mode 100644 drivers/ras/hisilicon/page_eject.c -- 2.25.1

2 5

[PATCH OLK-6.6 0/5] KABI reservation for driver
by Yi Yang 04 Feb '24

04 Feb '24

KABI reservation for tty/mtd/mmc/ipmi Yi Yang (5): tty: kabi: KABI reservation for tty mtd: kabi: KABI reservation for mtd mmc: kabi: KABI reservation for mmc ipmi: kabi: KABI reservation for ipmi audit: kabi: Remove extra semicolons drivers/char/ipmi/ipmi_msghandler.c | 6 ++++++ include/linux/ipmi.h | 2 ++ include/linux/ipmi_smi.h | 3 +++ include/linux/mmc/card.h | 6 ++++++ include/linux/mmc/host.h | 8 ++++++++ include/linux/mtd/mtd.h | 6 ++++++ include/linux/tty.h | 7 +++++++ include/linux/tty_buffer.h | 5 +++++ include/linux/tty_driver.h | 3 +++ include/linux/tty_ldisc.h | 3 +++ include/linux/tty_port.h | 3 +++ kernel/audit.h | 4 ++-- 12 files changed, 54 insertions(+), 2 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-1.0-LTS v2 0/2] CVE-2023-52340
by Ziyang Xuan 04 Feb '24

04 Feb '24

The patchset for CVE-2023-52340. v2: - Fix comment header. Jon Maxwell (2): ipv6: remove max_size check inline with ipv4 ipv6: Document that max_size sysctl is deprecated Documentation/networking/ip-sysctl.txt | 3 +++ include/net/dst_ops.h | 2 +- net/core/dst.c | 8 ++------ net/ipv6/route.c | 13 +++++-------- 4 files changed, 11 insertions(+), 15 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-6.6 1869/2940] drivers/cpufreq/cppc_cpufreq.c:852:26: error: invalid use of undefined type 'struct fb_ctr_pair'
by kernel test robot 04 Feb '24

04 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0570b06ba8090c198595a26f8b1eb221e12ec70c commit: 12f136b2134d4ded731c3ef23ac08c85b9c0b1fa [1869/2940] cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate config: arm64-randconfig-004-20240202 (https://download.01.org/0day-ci/archive/20240204/202402041617.THbvDKTe-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240204/202402041617.THbvDKTe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402041617.THbvDKTe-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_get_perf_ctrs_pair': >> drivers/cpufreq/cppc_cpufreq.c:852:26: error: invalid use of undefined type 'struct fb_ctr_pair' 852 | int cpu = fb_ctrs->cpu; | ^~ drivers/cpufreq/cppc_cpufreq.c:855:47: error: invalid use of undefined type 'struct fb_ctr_pair' 855 | ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); | ^~ drivers/cpufreq/cppc_cpufreq.c:861:48: error: invalid use of undefined type 'struct fb_ctr_pair' 861 | return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); | ^~ drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_cpufreq_get_rate': >> drivers/cpufreq/cppc_cpufreq.c:866:16: error: variable 'fb_ctrs' has initializer but incomplete type 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~~~~~~~~~ >> drivers/cpufreq/cppc_cpufreq.c:866:41: error: 'struct fb_ctr_pair' has no member named 'cpu' 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~ drivers/cpufreq/cppc_cpufreq.c:866:47: warning: excess elements in struct initializer 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~ drivers/cpufreq/cppc_cpufreq.c:866:47: note: (near initialization for 'fb_ctrs') >> drivers/cpufreq/cppc_cpufreq.c:866:28: error: storage size of 'fb_ctrs' isn't known 866 | struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; | ^~~~~~~ drivers/cpufreq/cppc_cpufreq.c:866:28: warning: unused variable 'fb_ctrs' [-Wunused-variable] vim +852 drivers/cpufreq/cppc_cpufreq.c 848 849 static int cppc_get_perf_ctrs_pair(void *val) 850 { 851 struct fb_ctr_pair *fb_ctrs = val; > 852 int cpu = fb_ctrs->cpu; 853 int ret; 854 855 ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); 856 if (ret) 857 return ret; 858 859 udelay(2); /* 2usec delay between sampling */ 860 861 return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); 862 } 863 864 static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) 865 { > 866 struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; 867 struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); 868 struct cppc_cpudata *cpu_data = policy->driver_data; 869 u64 delivered_perf; 870 int ret; 871 872 cpufreq_cpu_put(policy); 873 874 if (cpu_has_amu_feat(cpu)) 875 ret = smp_call_on_cpu(cpu, cppc_get_perf_ctrs_pair, 876 &fb_ctrs, false); 877 else 878 ret = cppc_get_perf_ctrs_pair(&fb_ctrs); 879 880 if (ret) 881 return 0; 882 883 delivered_perf = cppc_perf_from_fbctrs(cpu_data, 884 &fb_ctrs.fb_ctrs_t0, 885 &fb_ctrs.fb_ctrs_t1); 886 887 return cppc_cpufreq_perf_to_khz(cpu_data, delivered_perf); 888 } 889 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] scsi: scsi_transport_fc: kabi: KABI reservation for scsi_transport_fc
by Li Nan 04 Feb '24

04 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I910BZ -------------------------------- Reserve KABI for file scsi_transport_fc.h. Signed-off-by: Li Nan <linan122(a)huawei.com> --- include/scsi/scsi_transport_fc.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h index 483513c57597..3e2349132fb3 100644 --- a/include/scsi/scsi_transport_fc.h +++ b/include/scsi/scsi_transport_fc.h @@ -383,6 +383,27 @@ struct fc_rport { /* aka fc_starget_attrs */ struct work_struct stgt_delete_work; struct work_struct rport_delete_work; struct request_queue *rqst_q; /* bsg support */ + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) + KABI_RESERVE(20) } __attribute__((aligned(sizeof(unsigned long)))); /* bit field values for struct fc_rport "flags" field: */ @@ -765,6 +786,15 @@ struct fc_function_template { unsigned long show_host_system_hostname:1; unsigned long disable_target_scan:1; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; /** -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: iscsi: kabi: KABI reservation for scsi_transport_iscsi.h
by Li Nan 04 Feb '24

04 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I91059 ---------------------------------------------------------------------- Reserve KABI for file scsi_transport_iscsi.h. Signed-off-by: Li Nan <linan122(a)huawei.com> --- include/scsi/scsi_transport_iscsi.h | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h index fb3399e4cd29..d16f8baa3817 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -156,6 +156,11 @@ struct iscsi_transport { int (*logout_flashnode_sid) (struct iscsi_cls_session *cls_sess); int (*get_host_stats) (struct Scsi_Host *shost, char *buf, int len); u8 (*check_protection)(struct iscsi_task *task, sector_t *sector); + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; /* @@ -218,6 +223,15 @@ struct iscsi_cls_conn { struct device dev; /* sysfs transport/container device */ enum iscsi_connection_state state; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; #define iscsi_dev_to_conn(_dev) \ @@ -276,6 +290,15 @@ struct iscsi_cls_session { int sid; /* session id */ void *dd_data; /* LLD private data */ struct device dev; /* sysfs transport/container device */ + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; #define iscsi_dev_to_session(_dev) \ @@ -308,6 +331,11 @@ struct iscsi_endpoint { struct device dev; int id; struct iscsi_cls_conn *conn; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; struct iscsi_iface { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] netfilter: nf_tables: reject QUEUE/DROP verdict parameters
by Dong Chenchen 04 Feb '24

04 Feb '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.8-rc2 commit f342de4e2f33e0e39165d8639387aa6c19dff660 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I90B2K CVE: CVE-2024-1086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This reverts commit e0abdadcc6e1. core.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP verdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar, or 0. Due to the reverted commit, its possible to provide a positive value, e.g. NF_ACCEPT (1), which results in use-after-free. Its not clear to me why this commit was made. NF_QUEUE is not used by nftables; "queue" rules in nftables will result in use of "nft_queue" expression. If we later need to allow specifiying errno values from userspace (do not know why), this has to call NF_DROP_GETERR and check that "err <= 0" holds true. Fixes: e0abdadcc6e1 ("netfilter: nf_tables: accept QUEUE/DROP verdict parameters") Cc: stable(a)vger.kernel.org Reported-by: Notselwyn <notselwyn(a)pwning.tech> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index e07c497e7344..3ee5beb220bd 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7175,16 +7175,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); switch (data->verdict.code) { - default: - switch (data->verdict.code & NF_VERDICT_MASK) { - case NF_ACCEPT: - case NF_DROP: - case NF_QUEUE: - break; - default: - return -EINVAL; - } - /* fall through */ + case NF_ACCEPT: + case NF_DROP: + case NF_QUEUE: + break; case NFT_CONTINUE: case NFT_BREAK: case NFT_RETURN: @@ -7203,6 +7197,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, chain->use++; data->verdict.chain = chain; break; + default: + return -EINVAL; } desc->len = sizeof(data->verdict); -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/ascend: Make enable_oom_killer feature depends on ASCEND_FEATURE
by Yuan Can 04 Feb '24

04 Feb '24

ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I90WBX CVE: NA ------------------------------------------------- The enable_oom_killer feature is only used on ascend platform, make its config depends on ASCEND_FEATURE. Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 1 - mm/Kconfig | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 77f0c7ae79c1..d4027ab5893a 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -1171,7 +1171,6 @@ CONFIG_LRU_GEN=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y -# CONFIG_ASCEND_OOM is not set # CONFIG_PAGE_CACHE_LIMIT is not set CONFIG_DYNAMIC_POOL=y CONFIG_ETMEM_SCAN=m diff --git a/mm/Kconfig b/mm/Kconfig index f45bc11c1cb2..56f80e2e3a6f 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1314,6 +1314,7 @@ config SHARE_POOL config ASCEND_OOM bool "Enable support for disable oom killer" + depends on ASCEND_FEATURES default n help In some cases we hopes that the oom will not kill the process when it occurs, -- 2.17.1

2 1