February 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] kabi: reserve space for pci subsystem and thread_info
by Jialin Zhang 02 Feb '24

02 Feb '24

Reserve space for pci subsystem and thread_info Jialin Zhang (1): kabi: reserve space for thread_info structure Tan Xiaojun (1): kabi: reserve space for pci subsystem related structure arch/arm64/include/asm/thread_info.h | 4 ++++ arch/x86/include/asm/thread_info.h | 4 ++++ drivers/pci/pci.h | 9 ++++++++ include/linux/pci.h | 34 ++++++++++++++++++++++++++++ include/linux/pci_hotplug.h | 18 +++++++++++++++ 5 files changed, 69 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6] openeuler_defconfig: enable CONFIG_PAGE_CACHE_LIMIT
by Ze Zuo 02 Feb '24

02 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8NIKC -------------------------------- Enable CONFIG_PAGE_CACHE_LIMIT for x86, arm64 by default. Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 2ddea5999010..e6c9474e032a 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1161,7 +1161,7 @@ CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y # CONFIG_ASCEND_FEATURES is not set # CONFIG_ASCEND_OOM is not set -# CONFIG_PAGE_CACHE_LIMIT is not set +CONFIG_PAGE_CACHE_LIMIT=y # CONFIG_CLEAR_FREELIST_PAGE is not set CONFIG_MEMORY_RELIABLE=y CONFIG_DYNAMIC_POOL=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 77f0c7ae79c1..e97820a0ec30 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -1172,7 +1172,7 @@ CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y # CONFIG_ASCEND_OOM is not set -# CONFIG_PAGE_CACHE_LIMIT is not set +CONFIG_PAGE_CACHE_LIMIT=y CONFIG_DYNAMIC_POOL=y CONFIG_ETMEM_SCAN=m CONFIG_ETMEM_SWAP=m -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS v2] drm/atomic: Fix potential use-after-free in nonblocking commits
by Guo Mengqi 02 Feb '24

02 Feb '24

From: Daniel Vetter <daniel.vetter(a)ffwll.ch> stable inclusion from stable-v5.10.188 commit f09c0ac142c59495262dd80545f261b2aeeba538 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YD5O CVE: CVE-2023-51043 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4e076c73e4f6e90816b30fcd4a0d7ab365087255 upstream. This requires a bit of background. Properly done a modeset driver's unload/remove sequence should be drm_dev_unplug(); drm_atomic_helper_shutdown(); drm_dev_put(); The trouble is that the drm_dev_unplugged() checks are by design racy, they do not synchronize against all outstanding ioctl. This is because those ioctl could block forever (both for modeset and for driver specific ioctls), leading to deadlocks in hotunplug. Instead the code sections that touch the hardware need to be annotated with drm_dev_enter/exit, to avoid accessing hardware resources after the unload/remove has finished. To avoid use-after-free issues all the involved userspace visible objects are supposed to hold a reference on the underlying drm_device, like drm_file does. The issue now is that we missed one, the atomic modeset ioctl can be run in a nonblocking fashion, and in that case it cannot rely on the implied drm_device reference provided by the ioctl calling context. This can result in a use-after-free if an nonblocking atomic commit is carefully raced against a driver unload. Fix this by unconditionally grabbing a drm_device reference for any drm_atomic_state structures. Strictly speaking this isn't required for blocking commits and TEST_ONLY calls, but it's the simpler approach. Thanks to shanzhulig for the initial idea of grabbing an unconditional reference, I just added comments, a condensed commit message and fixed a minor potential issue in where exactly we drop the final reference. Reported-by: shanzhulig <shanzhulig(a)gmail.com> Suggested-by: shanzhulig <shanzhulig(a)gmail.com> Reviewed-by: Maxime Ripard <mripard(a)kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: stable(a)kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/drm_atomic.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 98b659981f1a..b10ba5057735 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -98,6 +98,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state) if (!state->planes) goto fail; + /* + * Because drm_atomic_state can be committed asynchronously we need our + * own reference and cannot rely on the on implied by drm_file in the + * ioctl call. + */ + drm_dev_get(dev); state->dev = dev; DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state); @@ -257,7 +263,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear); void __drm_atomic_state_free(struct kref *ref) { struct drm_atomic_state *state = container_of(ref, typeof(*state), ref); - struct drm_mode_config *config = &state->dev->mode_config; + struct drm_device *dev = state->dev; + struct drm_mode_config *config = &dev->mode_config; drm_atomic_state_clear(state); @@ -269,6 +276,8 @@ void __drm_atomic_state_free(struct kref *ref) drm_atomic_state_default_release(state); kfree(state); } + + drm_dev_put(dev); } EXPORT_SYMBOL(__drm_atomic_state_free); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2 v2] drm/atomic: Fix potential use-after-free in nonblocking commits
by Guo Mengqi 02 Feb '24

02 Feb '24

From: Daniel Vetter <daniel.vetter(a)ffwll.ch> stable inclusion from stable-v5.10.188 commit f09c0ac142c59495262dd80545f261b2aeeba538 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YD5O CVE: CVE-2023-51043 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4e076c73e4f6e90816b30fcd4a0d7ab365087255 upstream. This requires a bit of background. Properly done a modeset driver's unload/remove sequence should be drm_dev_unplug(); drm_atomic_helper_shutdown(); drm_dev_put(); The trouble is that the drm_dev_unplugged() checks are by design racy, they do not synchronize against all outstanding ioctl. This is because those ioctl could block forever (both for modeset and for driver specific ioctls), leading to deadlocks in hotunplug. Instead the code sections that touch the hardware need to be annotated with drm_dev_enter/exit, to avoid accessing hardware resources after the unload/remove has finished. To avoid use-after-free issues all the involved userspace visible objects are supposed to hold a reference on the underlying drm_device, like drm_file does. The issue now is that we missed one, the atomic modeset ioctl can be run in a nonblocking fashion, and in that case it cannot rely on the implied drm_device reference provided by the ioctl calling context. This can result in a use-after-free if an nonblocking atomic commit is carefully raced against a driver unload. Fix this by unconditionally grabbing a drm_device reference for any drm_atomic_state structures. Strictly speaking this isn't required for blocking commits and TEST_ONLY calls, but it's the simpler approach. Thanks to shanzhulig for the initial idea of grabbing an unconditional reference, I just added comments, a condensed commit message and fixed a minor potential issue in where exactly we drop the final reference. Reported-by: shanzhulig <shanzhulig(a)gmail.com> Suggested-by: shanzhulig <shanzhulig(a)gmail.com> Reviewed-by: Maxime Ripard <mripard(a)kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: stable(a)kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/drm_atomic.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 98b659981f1a..b10ba5057735 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -98,6 +98,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state) if (!state->planes) goto fail; + /* + * Because drm_atomic_state can be committed asynchronously we need our + * own reference and cannot rely on the on implied by drm_file in the + * ioctl call. + */ + drm_dev_get(dev); state->dev = dev; DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state); @@ -257,7 +263,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear); void __drm_atomic_state_free(struct kref *ref) { struct drm_atomic_state *state = container_of(ref, typeof(*state), ref); - struct drm_mode_config *config = &state->dev->mode_config; + struct drm_device *dev = state->dev; + struct drm_mode_config *config = &dev->mode_config; drm_atomic_state_clear(state); @@ -269,6 +276,8 @@ void __drm_atomic_state_free(struct kref *ref) drm_atomic_state_default_release(state); kfree(state); } + + drm_dev_put(dev); } EXPORT_SYMBOL(__drm_atomic_state_free); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] drm/atomic: Fix potential use-after-free in nonblocking commits
by Guo Mengqi 02 Feb '24

02 Feb '24

From: Daniel Vetter <daniel.vetter(a)ffwll.ch> stable inclusion from stable-v5.10.188 commit f09c0ac142c59495262dd80545f261b2aeeba538 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YD5O CVE: CVE-2023-51043 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4e076c73e4f6e90816b30fcd4a0d7ab365087255 upstream. This requires a bit of background. Properly done a modeset driver's unload/remove sequence should be drm_dev_unplug(); drm_atomic_helper_shutdown(); drm_dev_put(); The trouble is that the drm_dev_unplugged() checks are by design racy, they do not synchronize against all outstanding ioctl. This is because those ioctl could block forever (both for modeset and for driver specific ioctls), leading to deadlocks in hotunplug. Instead the code sections that touch the hardware need to be annotated with drm_dev_enter/exit, to avoid accessing hardware resources after the unload/remove has finished. To avoid use-after-free issues all the involved userspace visible objects are supposed to hold a reference on the underlying drm_device, like drm_file does. The issue now is that we missed one, the atomic modeset ioctl can be run in a nonblocking fashion, and in that case it cannot rely on the implied drm_device reference provided by the ioctl calling context. This can result in a use-after-free if an nonblocking atomic commit is carefully raced against a driver unload. Fix this by unconditionally grabbing a drm_device reference for any drm_atomic_state structures. Strictly speaking this isn't required for blocking commits and TEST_ONLY calls, but it's the simpler approach. Thanks to shanzhulig for the initial idea of grabbing an unconditional reference, I just added comments, a condensed commit message and fixed a minor potential issue in where exactly we drop the final reference. Reported-by: shanzhulig <shanzhulig(a)gmail.com> Suggested-by: shanzhulig <shanzhulig(a)gmail.com> Reviewed-by: Maxime Ripard <mripard(a)kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: stable(a)kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/drm_atomic.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 98b659981f1a..b10ba5057735 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -98,6 +98,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state) if (!state->planes) goto fail; + /* + * Because drm_atomic_state can be committed asynchronously we need our + * own reference and cannot rely on the on implied by drm_file in the + * ioctl call. + */ + drm_dev_get(dev); state->dev = dev; DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state); @@ -257,7 +263,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear); void __drm_atomic_state_free(struct kref *ref) { struct drm_atomic_state *state = container_of(ref, typeof(*state), ref); - struct drm_mode_config *config = &state->dev->mode_config; + struct drm_device *dev = state->dev; + struct drm_mode_config *config = &dev->mode_config; drm_atomic_state_clear(state); @@ -269,6 +276,8 @@ void __drm_atomic_state_free(struct kref *ref) drm_atomic_state_default_release(state); kfree(state); } + + drm_dev_put(dev); } EXPORT_SYMBOL(__drm_atomic_state_free); -- 2.17.1

2 1

[PATCH OLK-6.6] kabi:dma:add kabi reserve for dma_map_ops structure
by Ze Zuo 02 Feb '24

02 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZYKD --------------------------- Reserve space for dma_map_ops on dma-map-ops.h. Sgned-off-by: Ze Zuo <zuoze1(a)huawe.com> --- include/linux/dma-map-ops.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h index f2fc203fb8a1..a37e85e7a5c6 100644 --- a/include/linux/dma-map-ops.h +++ b/include/linux/dma-map-ops.h @@ -82,6 +82,12 @@ struct dma_map_ops { size_t (*max_mapping_size)(struct device *dev); size_t (*opt_mapping_size)(void); unsigned long (*get_merge_boundary)(struct device *dev); + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) }; #ifdef CONFIG_DMA_OPS -- 2.25.1

2 1

[openEuler-1.0-LTS 0/2] patchset for CVE-2023-52340
by Ziyang Xuan 02 Feb '24

02 Feb '24

The patchset for CVE-2023-52340. Jon Maxwell (2): ipv6: remove max_size check inline with ipv4 ipv6: Document that max_size sysctl is deprecated Documentation/networking/ip-sysctl.txt | 3 +++ include/net/dst_ops.h | 2 +- net/core/dst.c | 8 ++------ net/ipv6/route.c | 13 +++++-------- 4 files changed, 11 insertions(+), 15 deletions(-) -- 2.25.1

1 2

[PATCH OLK-6.6 0/4] KABI: Add reserve space for sched structures
by Zheng Zucheng 02 Feb '24

02 Feb '24

From: Guan Jing <guanjing6(a)huawei.com> KABI: Add reserve space for sched structures Guan Jing (4): KABI: Add reserve space for sched structures fork: Allocate a new task_struct_resvd object for fork task KABI: Reserve space for struct module KABI: Reserve space for fwnode.h include/linux/fwnode.h | 7 +++++++ include/linux/module.h | 4 ++++ include/linux/sched.h | 40 ++++++++++++++++++++++++++++++++++++ include/linux/sched/signal.h | 5 +++++ init/init_task.c | 5 +++++ kernel/fork.c | 21 ++++++++++++++++++- kernel/sched/sched.h | 35 ++++++++++++++++++++++++++++++- 7 files changed, 115 insertions(+), 2 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] KABI: Add reserve space for sched structures
by Zheng Zucheng 02 Feb '24

02 Feb '24

From: Guan Jing <guanjing6(a)huawei.com> KABI: Add reserve space for sched structures Guan Jing (2): KABI: Add reserve space for sched structures fork: Allocate a new task_struct_resvd object for fork task include/linux/fwnode.h | 7 +++++++ include/linux/module.h | 4 ++++ include/linux/sched.h | 30 ++++++++++++++++++++++++++++++ include/linux/sched/signal.h | 5 +++++ init/init_task.c | 5 +++++ kernel/fork.c | 21 ++++++++++++++++++++- kernel/sched/sched.h | 35 ++++++++++++++++++++++++++++++++++- 7 files changed, 105 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] tracing: Backport bugfix
by Zheng Yejian 02 Feb '24

02 Feb '24

Steven Rostedt (Google) (1): tracing: Increase trace array ref count on enable and filter files Zheng Yejian (1): tracing: Fix uaf issue when open the hist or hist_debug file kernel/trace/trace.c | 33 ++++++++++++++++++++++++++++++++ kernel/trace/trace.h | 3 +++ kernel/trace/trace_events.c | 6 ++++-- kernel/trace/trace_events_hist.c | 12 ++++++++---- 4 files changed, 48 insertions(+), 6 deletions(-) -- 2.25.1

2 3