February 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] fs:/dcache.c: fix negative dentry flag warning in dentry_free
by Long Li 21 Feb '24

21 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8JH5M CVE: NA -------------------------------- While run xfstests generic/429 on ext4, we get following report: WARNING: CPU: 4 PID: 5749 at fs/dcache.c:349 dentry_free.cold+0x20/0x76 CPU: 4 PID: 5749 Comm: t_encrypted_d_r Not tainted 4.19.90-00004-g0ec2c5ee4e0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 RIP: 0010:dentry_free.cold+0x20/0x76 RSP: 0018:ffffbc0944a5bdf0 EFLAGS: 00010202 RAX: 0000000000000024 RBX: ffff955f06e74f30 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff955f3bb168f8 RDI: ffff955f3bb168f8 RBP: ffff955f06e4c6c0 R08: ffff955f3bb168f8 R09: 0000000000000005 R10: 0000000000000c27 R11: ffffffffb57d3bad R12: ffff955f06e4c718 R13: ffff955f06e4c718 R14: ffff955f06e74f30 R15: 0000000000000000 FS: 00007f4ba0307b40(0000) GS:ffff955f3bb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4b9bcd1ff8 CR3: 0000000123666000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __dentry_kill+0x219/0x340 shrink_dentry_list+0xee/0x3e0 shrink_dcache_parent+0x8c/0xc0 vfs_rmdir+0x142/0x230 do_rmdir+0x1c2/0x250 __x64_sys_rmdir+0x1b/0x30 do_syscall_64+0xcb/0x370 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Look at generic/429 test case, removing the directory and accessing the file that do not exist in the directory is done concurrently here. Consider the following concurrent call flow, which triggers the warning of negative dentry flag in dentry_free(). The root cause of the problem is that lack of lock protection when determining whether the dentry needs to make a fast put, it causes that the DCACHE_NEGATIVE_ACCOUNT flag to be set incorrectly. rmdir stat file ------------------------- ------------------------- fast_dput if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry)) shrink_dentry_list spin_lock(&dentry->d_lock) d_shrink_del(dentry) <clear DCACHE_LRU_LIST> __dentry_kill(dentry) dentry_unlist(dentry, parent) dentry->d_flags &= ~DCACHE_NEGATIVE_ACCOUNT <clear DCACHE_NEGATIVE_ACCOUNT> spin_unlock(&dentry->d_lock) spin_lock(&dentry->d_lock) limit_negative_dentry(dentry) <set DCACHE_NEGATIVE_ACCOUNT> spin_unlock(&dentry->d_lock) dentry_free(dentry) WARN_ON(dentry->d_flags & DCACHE_NEGATIVE_ACCOUNT) Fix the problem by checking the dentry is dead before set neagtive flag. Fixes: e91cbe162d54 ("fs:/dcache.c: fix negative dentry limit not complete problem") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/dcache.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/dcache.c b/fs/dcache.c index ab5f8e954978..36db55960158 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -682,6 +682,10 @@ static inline bool limit_negative_dentry(struct dentry *dentry) { struct dentry *parent; + /* The dentry is now unrecoverably dead, shuoldn't limit */ + if (unlikely(dentry->d_lockref.count < 0)) + return false; + parent = dentry->d_parent; if (unlikely(!parent)) return false; -- 2.31.1

2 1

[PATCH OLK-6.6 0/1] Feature: export vcpustat
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-6.6 00/12] Add kabi reserve
by Wang Wensheng 20 Feb '24

20 Feb '24

Wang Wensheng (12): delayacct: Reserve kabi for task_delay_info xarray: Reserve kabi for xa_state sbitmap: Add kabi reserve iommu: Add kabi reserve drm: Add kabi reserve in drm_mode_config.h drm: Add kabi reserve in drm_modeset_lock.h drm: Add kabi reserve in drm_plane.h drm: Add kabi reserve in drm_syncobj.h drm: Add kabi reserve in drm_gpu_scheduler.h drm/ttm: Add kabi reserve in ttm_bo.h drm/ttm: Add kabi reserve in ttm_resource.h drm/ttm: Add kabi reserve in ttm_tt.h include/drm/drm_mode_config.h | 5 +++++ include/drm/drm_modeset_lock.h | 3 +++ include/drm/drm_plane.h | 9 +++++++++ include/drm/drm_syncobj.h | 3 +++ include/drm/gpu_scheduler.h | 15 +++++++++++++++ include/drm/ttm/ttm_bo.h | 7 +++++++ include/drm/ttm/ttm_resource.h | 13 +++++++++++++ include/drm/ttm/ttm_tt.h | 3 +++ include/linux/delayacct.h | 3 +++ include/linux/iommu.h | 17 +++++++++++++++++ include/linux/sbitmap.h | 9 +++++++++ include/linux/xarray.h | 3 +++ 12 files changed, 90 insertions(+) -- 2.17.1

2 13

[PATCH OLK-6.6 0/1] Feature: export vcpustat
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-6.6 0/1] Feature: export vcpustat
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-6.6 0/1] Feature: smart halt poll support for arm
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-5.10] arm64/mpam: update reminder message about MBHDL option
by Zeng Heng 20 Feb '24

20 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I91YTV CVE: NA ---------------------------------------- Corrected debugging reminder information about MBHDL option of schemata interface. # echo "MBHDL:1=2" > schemata -bash: echo: write error: Invalid argument # cat info/last_cmd_status MB value 2 exceed 1 Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_resctrl.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 174f84893ee5..bc314b181132 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -340,15 +340,16 @@ parse_bw(char *buf, struct resctrl_resource *r, return -EINVAL; } + if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { + rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + return -EINVAL; + } + switch (rr->ctrl_features[type].evt) { case QOS_MBA_MAX_EVENT_ID: case QOS_MBA_PBM_EVENT_ID: case QOS_MBA_MIN_EVENT_ID: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); - return -EINVAL; - } - if (data < r->mbw.min_bw) { + if (data < r->mbw.min_bw || data >= rr->ctrl_features[type].max_wd) { rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); return -EINVAL; @@ -356,19 +357,14 @@ parse_bw(char *buf, struct resctrl_resource *r, data = roundup(data, r->mbw.bw_gran); break; default: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + if (data >= rr->ctrl_features[type].max_wd) { + rdt_last_cmd_printf("MB value %ld exceed %d\n", data, + rr->ctrl_features[type].max_wd - 1); return -EINVAL; } break; } - if (data >= rr->ctrl_features[type].max_wd) { - rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, - r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); - return -EINVAL; - } - cfg->new_ctrl[type] = data; cfg->ctrl_updated[type] = true; cfg->have_new_ctrl = true; -- 2.25.1

2 1

[PATCH OLK-6.6] ubi: Check for too small LEB size in VTBL code
by ZhaoLong Wang 20 Feb '24

20 Feb '24

From: Richard Weinberger <richard(a)nod.at> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L79 CVE: CVE-2024-25739 Reference: https://www.spinics.net/lists/kernel/msg5074816.html ---------------------------------------- If the LEB size is smaller than a volume table record we cannot have volumes. In this case abort attaching. Cc: Chenyuan Yang <cy54(a)illinois.edu> Cc: stable(a)vger.kernel.org Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Chenyuan Yang <cy54(a)illinois.edu> Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illi… Signed-off-by: Richard Weinberger <richard(a)nod.at> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/vtbl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c index f700f0e4f2ec..6e5489e233dd 100644 --- a/drivers/mtd/ubi/vtbl.c +++ b/drivers/mtd/ubi/vtbl.c @@ -791,6 +791,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) * The number of supported volumes is limited by the eraseblock size * and by the UBI_MAX_VOLUMES constant. */ + + if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { + ubi_err(ubi, "LEB size too small for a volume record"); + return -EINVAL; + } + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; if (ubi->vtbl_slots > UBI_MAX_VOLUMES) ubi->vtbl_slots = UBI_MAX_VOLUMES; -- 2.34.3

2 1

[PATCH OLK-5.10] ubi: Check for too small LEB size in VTBL code
by ZhaoLong Wang 20 Feb '24

20 Feb '24

From: Richard Weinberger <richard(a)nod.at> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L79 CVE: CVE-2024-25739 Reference: https://www.spinics.net/lists/kernel/msg5074816.html ---------------------------------------- If the LEB size is smaller than a volume table record we cannot have volumes. In this case abort attaching. Cc: Chenyuan Yang <cy54(a)illinois.edu> Cc: stable(a)vger.kernel.org Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Chenyuan Yang <cy54(a)illinois.edu> Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illi… Signed-off-by: Richard Weinberger <richard(a)nod.at> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/vtbl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c index f700f0e4f2ec..6e5489e233dd 100644 --- a/drivers/mtd/ubi/vtbl.c +++ b/drivers/mtd/ubi/vtbl.c @@ -791,6 +791,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) * The number of supported volumes is limited by the eraseblock size * and by the UBI_MAX_VOLUMES constant. */ + + if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { + ubi_err(ubi, "LEB size too small for a volume record"); + return -EINVAL; + } + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; if (ubi->vtbl_slots > UBI_MAX_VOLUMES) ubi->vtbl_slots = UBI_MAX_VOLUMES; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] ubi: Check for too small LEB size in VTBL code
by ZhaoLong Wang 20 Feb '24

20 Feb '24

From: Richard Weinberger <richard(a)nod.at> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L79 CVE: CVE-2024-25739 Reference: https://www.spinics.net/lists/kernel/msg5074816.html ---------------------------------------- If the LEB size is smaller than a volume table record we cannot have volumes. In this case abort attaching. Cc: Chenyuan Yang <cy54(a)illinois.edu> Cc: stable(a)vger.kernel.org Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Chenyuan Yang <cy54(a)illinois.edu> Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illi… Signed-off-by: Richard Weinberger <richard(a)nod.at> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/vtbl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c index 1bc82154bb18..634ec95a1e71 100644 --- a/drivers/mtd/ubi/vtbl.c +++ b/drivers/mtd/ubi/vtbl.c @@ -804,6 +804,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) * The number of supported volumes is limited by the eraseblock size * and by the UBI_MAX_VOLUMES constant. */ + + if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { + ubi_err(ubi, "LEB size too small for a volume record"); + return -EINVAL; + } + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; if (ubi->vtbl_slots > UBI_MAX_VOLUMES) ubi->vtbl_slots = UBI_MAX_VOLUMES; -- 2.34.3

2 1