February 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] uio: Fix use-after-free in uio_open
by Guo Mengqi 23 Feb '24

23 Feb '24

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v5.10.209 commit 5e0be1229ae199ebb90b33102f74a0f22d152570 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXN CVE: CVE-2023-52439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") Cc: stable <stable(a)kernel.org> Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@li… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index be06f1a961c2..f453b3c7ee42 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) mutex_lock(&minor_lock); idev = idr_find(&uio_idr, iminor(inode)); - mutex_unlock(&minor_lock); if (!idev) { ret = -ENODEV; + mutex_unlock(&minor_lock); goto out; } - get_device(&idev->dev); + mutex_unlock(&minor_lock); if (!try_module_get(idev->owner)) { ret = -ENODEV; @@ -1062,9 +1062,8 @@ void uio_unregister_device(struct uio_info *info) wake_up_interruptible(&idev->wait); kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - device_unregister(&idev->dev); - uio_free_minor(minor); + device_unregister(&idev->dev); return; } -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] uio: Fix use-after-free in uio_open
by Guo Mengqi 23 Feb '24

23 Feb '24

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v4.19.306 commit 3174e0f7de1ba392dc191625da83df02d695b60c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXN CVE: CVE-2023-52439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") Cc: stable <stable(a)kernel.org> Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@li… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index f43498e5cfb8..facccb36f692 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) mutex_lock(&minor_lock); idev = idr_find(&uio_idr, iminor(inode)); - mutex_unlock(&minor_lock); if (!idev) { ret = -ENODEV; + mutex_unlock(&minor_lock); goto out; } - get_device(&idev->dev); + mutex_unlock(&minor_lock); if (!try_module_get(idev->owner)) { ret = -ENODEV; @@ -1024,9 +1024,8 @@ void uio_unregister_device(struct uio_info *info) wake_up_interruptible(&idev->wait); kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - device_unregister(&idev->dev); - uio_free_minor(minor); + device_unregister(&idev->dev); return; } -- 2.17.1

2 1

[PATCH OLK-6.6 0/3] audit: Backport mainline patches
by GUO Zihua 23 Feb '24

23 Feb '24

This series backports mainline bugfixes for audit. Jan Kara (3): audit_tree: Remove mark->lock locking audit: Fix possible spurious -ENOSPC error audit: Fix possible tagging failures kernel/audit_tree.c | 61 ++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/1] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 23 Feb '24

23 Feb '24

This patch backports mainline bugfix commit 0b9dc6c9f01c ("keys: safe concurrent user->{session,uid}_keyring access") Jann Horn (1): keys: safe concurrent user->{session,uid}_keyring access include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 23 Feb '24

23 Feb '24

This patch backports mainline bugfix commit 0b9dc6c9f01c ("keys: safe concurrent user->{session,uid}_keyring access") Jann Horn (1): keys: safe concurrent user->{session,uid}_keyring access include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/3] audit: Backport mainline patches
by GUO Zihua 23 Feb '24

23 Feb '24

Backported mainline bugfix for audit. Jan Kara (3): audit_tree: Remove mark->lock locking audit: Fix possible spurious -ENOSPC error audit: Fix possible tagging failures kernel/audit_tree.c | 61 ++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 1/5] driver/svm: support SVSP feature, interface definition
by Yuan Can 23 Feb '24

23 Feb '24

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I931MI CVE: NA ----------------------------------------------------------------- In the SVA scenario, the master device of the SMMU can access the address space of the process by the operation of binding process. The page table of the process is shared by the MMU and SMMU, In this case, if some addrss range cannot be accessed through the MMU, access to this address range needs to be isolated from the process page table. If the default domain of the SMMU is used, the isolation can be achieved. However, the address space created by default domain do not like the address space of the process which can be shared by multiple SMMUs. Therefore, we add a shadow virtual space of process. This address space is used only by the SMMU. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> --- arch/arm64/Kconfig | 15 +++++++++++++++ kernel/fork.c | 1 + mm/mmap.c | 1 + 3 files changed, 17 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 67bc2ad13453..3e84b2572827 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2455,6 +2455,21 @@ config DMI However, even with this option, the resultant kernel should continue to boot on existing non-UEFI platforms. +config ASCEND_SVSP + bool "Enable support for SVSP" + default n + depends on ARM_SMMU_V3_SVA + help + SVSP means Shadow Virtual Space of Process, which is an IO space used for + master device of SMMU. + + This space is only used for the master device, since the target address + after traslation by MMU is not an accessible physical address, but can + accessible by SMMU. + + Therefore, in the sva scenario, an svsp is created for each target process + address space. + endmenu # "Boot options" config COMPAT diff --git a/kernel/fork.c b/kernel/fork.c index 00e5886c9e04..735bc670b49e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1373,6 +1373,7 @@ struct mm_struct *mm_alloc(void) memset(mm, 0, sizeof(*mm)); return mm_init(mm, current, current_user_ns()); } +EXPORT_SYMBOL_GPL(mm_alloc); static inline void __mmput(struct mm_struct *mm) { diff --git a/mm/mmap.c b/mm/mmap.c index 21d1fc39bf21..5d78ebaeed60 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2684,6 +2684,7 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, return do_vmi_munmap(&vmi, mm, start, len, uf, false); } +EXPORT_SYMBOL(do_munmap); static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, unsigned long addr, -- 2.17.1

3 7

[PATCH OLK-5.10 v3 0/2] CVE-2023-52435
by Ziyang Xuan 23 Feb '24

23 Feb '24

Patchset for CVE-2023-52435. v3: - Fix comment head of patch 2. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/9] Support PV sched feature
by lishusen 22 Feb '24

22 Feb '24

PV sched supports the vCPU preemption check to enhance lock performance on overcommitted hosts. Paravirtualized spinlocks allow a pvops backend to replace the spinlock implementation with something virtualization-friendly. PV qspinlock has a minimal impact on native kernels and gives a nice performance benefit on paravirtualized KVM kernels. Zengruan Ye (9): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check KVM: arm64: Add SMCCC PV-sched to kick cpu KVM: arm64: Implement PV_SCHED_KICK_CPU call KVM: arm64: Enable PV qspinlock KVM: arm64: Add tracepoints for PV qspinlock Documentation/virt/kvm/arm/pvsched.rst | 74 ++++++++ arch/arm64/Kconfig | 24 +++ arch/arm64/include/asm/Kbuild | 1 - arch/arm64/include/asm/kvm_host.h | 38 ++++ arch/arm64/include/asm/paravirt.h | 49 +++++ arch/arm64/include/asm/pvsched-abi.h | 16 ++ arch/arm64/include/asm/qspinlock.h | 48 +++++ arch/arm64/include/asm/qspinlock_paravirt.h | 12 ++ arch/arm64/include/asm/spinlock.h | 11 ++ arch/arm64/kernel/Makefile | 3 +- arch/arm64/kernel/paravirt-spinlocks.c | 21 +++ arch/arm64/kernel/paravirt.c | 187 ++++++++++++++++++++ arch/arm64/kernel/trace-paravirt.h | 66 +++++++ arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arm.c | 15 +- arch/arm64/kvm/handle_exit.c | 1 + arch/arm64/kvm/hypercalls.c | 20 +++ arch/arm64/kvm/pvsched.c | 82 +++++++++ arch/arm64/kvm/trace_arm.h | 18 ++ include/linux/arm-smccc.h | 25 +++ include/linux/cpuhotplug.h | 1 + 21 files changed, 710 insertions(+), 4 deletions(-) create mode 100644 Documentation/virt/kvm/arm/pvsched.rst create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/include/asm/qspinlock.h create mode 100644 arch/arm64/include/asm/qspinlock_paravirt.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 arch/arm64/kernel/trace-paravirt.h create mode 100644 arch/arm64/kvm/pvsched.c -- 2.33.0

2 10

[openeuler:OLK-6.6 2392/3331] arch/arm64/kernel/ipi_nmi.c:39:9: error: implicit declaration of function '__printk_safe_enter'
by kernel test robot 22 Feb '24

22 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0b30804544e281a67d384ea10249544d92a69e2f commit: 5e3e94b1477ca3f6cb47ae8137a4a99fe0ef6147 [2392/3331] arm64: Add non nmi ipi backtrace support config: arm64-randconfig-r064-20240222 (https://download.01.org/0day-ci/archive/20240222/202402222006.PH9PlsbP-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240222/202402222006.PH9PlsbP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402222006.PH9PlsbP-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/ipi_nmi.c: In function 'ipi_cpu_backtrace': >> arch/arm64/kernel/ipi_nmi.c:39:9: error: implicit declaration of function '__printk_safe_enter' [-Werror=implicit-function-declaration] 39 | __printk_safe_enter(); | ^~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/ipi_nmi.c:41:9: error: implicit declaration of function '__printk_safe_exit' [-Werror=implicit-function-declaration] 41 | __printk_safe_exit(); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/__printk_safe_enter +39 arch/arm64/kernel/ipi_nmi.c 35 36 #ifdef CONFIG_NON_NMI_IPI_BACKTRACE 37 static void ipi_cpu_backtrace(void *info) 38 { > 39 __printk_safe_enter(); 40 nmi_cpu_backtrace(get_irq_regs()); > 41 __printk_safe_exit(); 42 } 43 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0