February 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] mm/memcontrol: fix out-of-bound access in mem_cgroup_sysctls_init
by Jinjiang Tu 02 Feb '24

02 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I90E0C CVE: NA -------------------------------- Patchset[1] supports to remove the sentinel element in the ctl_table when registering it to sysctl. However, the patchset fails to handle when the array is empty, leading to out-of-bound access in insert_header. When CONFIG_MEMCG_OOM_PRIORITY and CONFIG_MEMCG_SWAP_QOS are disabled, mem_cgroup_sysctls is a empty array, mem_cgroup_sysctls_init() calls register_sysctl_init() to register it. This leads to out-of-bound access. The KASAN report is as follows: ================================================================== BUG: KASAN: global-out-of-bounds in insert_header+0x4b/0x2b0 Read of size 4 at addr ffffffff99c03a58 by task swapper/0/1 Call Trace: <TASK> dump_stack_lvl+0x37/0x50 print_address_description.constprop.0+0x6b/0x3d0 ? insert_header+0x4b/0x2b0 print_report+0xb5/0x270 ? kasan_addr_to_slab+0xd/0xa0 kasan_report+0xb0/0xe0 ? insert_header+0x4b/0x2b0 insert_header+0x4b/0x2b0 __register_sysctl_table+0x1d3/0x220 __register_sysctl_init+0x24/0x50 mem_cgroup_init+0x1cd/0x1e0 ? __pfx_mem_cgroup_init+0x10/0x10 do_one_initcall+0x8e/0x320 ? __pfx_do_one_initcall+0x10/0x10 ? __pfx_parse_args+0x10/0x10 ? __kmem_cache_alloc_node+0x1e0/0x480 ? kasan_set_track+0x25/0x30 ? __kasan_kmalloc+0x7f/0x90 do_initcalls+0xe0/0x1b0 kernel_init_freeable+0x242/0x320 ? __pfx_kernel_init+0x10/0x10 kernel_init+0x1f/0x1e0 ? calculate_sigpending+0x63/0x70 ret_from_fork+0x34/0x60 ? __pfx_kernel_init+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The buggy address belongs to the variable: mem_cgroup_sysctls+0x18/0x20 The buggy address belongs to the physical page: Memory state around the buggy address: ffffffff99c03900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff99c03980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff99c03a00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 ^ ffffffff99c03a80: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 ffffffff99c03b00: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 ================================================================== To fix it, check if mem_cgroup_sysctls is a empty array before calling register_sysctl_init(). [1] https://lore.kernel.org/lkml/20230809105006.1198165-1-j.granados@samsung.co… Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 346be8292294..df2fc279a666 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -8531,7 +8531,8 @@ static __init int mem_cgroup_sysctls_init(void) if (mem_cgroup_disabled()) return 0; - register_sysctl_init("vm", mem_cgroup_sysctls); + if (ARRAY_SIZE(mem_cgroup_sysctls)) + register_sysctl_init("vm", mem_cgroup_sysctls); return 0; } #else -- 2.25.1

2 1

[PATCH OLK-6.6] kabi: reserve space for workqueue subsystem related structure
by Zeng Heng 02 Feb '24

02 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9089C CVE: NA ------------------------------- Reserve space for workqueue subsystem. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/workqueue.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 24b1e5070f4d..39c67393e13b 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -6,6 +6,7 @@ #ifndef _LINUX_WORKQUEUE_H #define _LINUX_WORKQUEUE_H +#include <linux/kabi.h> #include <linux/timer.h> #include <linux/linkage.h> #include <linux/bitops.h> @@ -102,6 +103,9 @@ struct work_struct { #ifdef CONFIG_LOCKDEP struct lockdep_map lockdep_map; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) }; #define WORK_DATA_INIT() ATOMIC_LONG_INIT((unsigned long)WORK_STRUCT_NO_POOL) @@ -115,6 +119,9 @@ struct delayed_work { /* target workqueue and CPU ->timer uses to queue ->work */ struct workqueue_struct *wq; int cpu; + + KABI_RESERVE(1) + KABI_RESERVE(2) }; struct rcu_work { @@ -201,6 +208,11 @@ struct workqueue_attrs { * @ordered: work items must be executed one by one in queueing order */ bool ordered; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; static inline struct delayed_work *to_delayed_work(struct work_struct *work) -- 2.25.1

2 1

[PATCH OLK-6.6 v2] kabi: reserve space for struct ptp_clock
by Yang Yingliang 02 Feb '24

02 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8Z2NU CVE: NA ------------------------------- reserve space for struct ptp_clock. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/ptp/ptp_private.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h index b8d4f61f14be..22ada6de9057 100644 --- a/drivers/ptp/ptp_private.h +++ b/drivers/ptp/ptp_private.h @@ -15,6 +15,7 @@ #include <linux/ptp_clock.h> #include <linux/ptp_clock_kernel.h> #include <linux/time.h> +#include <linux/kabi.h> #define PTP_MAX_TIMESTAMPS 128 #define PTP_BUF_TIMESTAMPS 30 @@ -53,6 +54,10 @@ struct ptp_clock { struct mutex n_vclocks_mux; /* protect concurrent n_vclocks access */ bool is_virtual_clock; bool has_cycles; + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; #define info_to_vclock(d) container_of((d), struct ptp_vclock, info) -- 2.25.1

2 1

[PATCH OLK-6.6 v2] kabi: reserve space for struct ptp_clock
by Yang Yingliang 02 Feb '24

02 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8Z2NU CVE: NA ------------------------------- reserve space for struct ptp_clock. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/ptp/ptp_private.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h index b8d4f61f14be..22ada6de9057 100644 --- a/drivers/ptp/ptp_private.h +++ b/drivers/ptp/ptp_private.h @@ -15,6 +15,7 @@ #include <linux/ptp_clock.h> #include <linux/ptp_clock_kernel.h> #include <linux/time.h> +#include <linux/kabi.h> #define PTP_MAX_TIMESTAMPS 128 #define PTP_BUF_TIMESTAMPS 30 @@ -53,6 +54,10 @@ struct ptp_clock { struct mutex n_vclocks_mux; /* protect concurrent n_vclocks access */ bool is_virtual_clock; bool has_cycles; + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) }; #define info_to_vclock(d) container_of((d), struct ptp_vclock, info) -- 2.25.1

2 1

[PATCH v5 OLK-6.6 00/22] kabi reserve patches
by Lin Yujun 02 Feb '24

02 Feb '24

*** BLURB HERE *** Chen Jiahao (1): KABI: reserve space for struct input_dev Jialin Zhang (1): kabi: reserve space for power management related structure Lin Ruizhe (5): msi: Add kabi_reserve in msi.h interrupt: Add kabi_reserve in interrupt.h irq: Add kabi_reserve in irq irq_desc: Add kabi_reserve in irq_desc irqdomain: Add kabi_reserve in irqdomain Lin Yujun (14): drm: drm_atomic.h: Add kabi_reserve drm: drm_client.h: Add kabi_reserve drm: drm_connector.h: Add kabi_reserve drm: drm_crtc.h: Add kabi_reserve drm: drm_device.h: Add kabi_reserve drm: drm_drv.h: Add kabi_reserve drm: drm_fb_helper.h: Add kabi_reserve drm: drm_file.h: Add kabi_reserve drm: drm_fourcc.h: Add kabi_reserve drm: drm_gem.h: Add kabi_reserve pm: pm_domain.h: Add kabi_reserve pm: pm.h: Add kabi_reserve energy_model: Add kabi_reserve kabi: reserve space for arm64 cpufeature related structure Yang Yingliang (1): kabi: reserve space for struct cpu_stop_work arch/arm64/tools/cpucaps | 30 ++++++++++++++++++++++++++++++ include/drm/drm_atomic.h | 6 ++++++ include/drm/drm_client.h | 7 +++++++ include/drm/drm_connector.h | 18 ++++++++++++++++++ include/drm/drm_crtc.h | 7 +++++++ include/drm/drm_device.h | 4 ++++ include/drm/drm_drv.h | 5 +++++ include/drm/drm_fb_helper.h | 8 ++++++++ include/drm/drm_file.h | 8 ++++++++ include/drm/drm_fourcc.h | 5 +++++ include/drm/drm_gem.h | 8 ++++++++ include/linux/energy_model.h | 5 +++++ include/linux/input.h | 4 ++++ include/linux/interrupt.h | 6 ++++++ include/linux/irq.h | 8 ++++++++ include/linux/irqdesc.h | 4 +++- include/linux/irqdomain.h | 3 +++ include/linux/msi.h | 7 +++++++ include/linux/pm.h | 14 ++++++++++++++ include/linux/pm_domain.h | 10 ++++++++++ include/linux/pm_qos.h | 7 +++++++ include/linux/pm_wakeup.h | 4 ++++ include/linux/stop_machine.h | 3 +++ 23 files changed, 180 insertions(+), 1 deletion(-) -- 2.34.1

1 22

[PATCH OLK-5.10 v2 0/3] patchset for CVE-2023-52340
by Ziyang Xuan 02 Feb '24

02 Feb '24

The patchset for CVE-2023-52340. v2: - Fix comment head for patch 3. Jon Maxwell (2): ipv6: remove max_size check inline with ipv4 ipv6: Document that max_size sysctl is deprecated Ziyang Xuan (1): ipv6: fix kabi change in struct dst_ops Documentation/networking/ip-sysctl.rst | 3 +++ include/net/dst_ops.h | 2 +- net/core/dst.c | 8 ++------ net/ipv6/route.c | 13 +++++-------- 4 files changed, 11 insertions(+), 15 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/1] Remove unnecessary KABI reservation
by GUO Zihua 02 Feb '24

02 Feb '24

This patch set removes unnecessary KABI reservation. GUO Zihua (1): crypto: kabi: Removed unnecessary KABI reservation include/crypto/rng.h | 2 -- 1 file changed, 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/3] patchset for CVE-2023-52340
by Ziyang Xuan 02 Feb '24

02 Feb '24

The patchset for CVE-2023-52340. Jon Maxwell (2): ipv6: remove max_size check inline with ipv4 ipv6: Document that max_size sysctl is deprecated Ziyang Xuan (1): ipv6: fix kabi change in struct dst_ops Documentation/networking/ip-sysctl.rst | 3 +++ include/net/dst_ops.h | 2 +- net/core/dst.c | 8 ++------ net/ipv6/route.c | 13 +++++-------- 4 files changed, 11 insertions(+), 15 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 v2] reserve space for enum cc_attr.
by liwei 02 Feb '24

02 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I90N74 -------------------------------- Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/cc_platform.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h index cb0d6cd1c12f..8737411227a6 100644 --- a/include/linux/cc_platform.h +++ b/include/linux/cc_platform.h @@ -90,6 +90,12 @@ enum cc_attr { * Examples include TDX Guest. */ CC_ATTR_HOTPLUG_DISABLED, + + /* KABI reserve */ + CC_ATTR_KABI_RES1, + CC_ATTR_KABI_RES2, + CC_ATTR_KABI_RES3, + CC_ATTR_KABI_RES4, }; #ifdef CONFIG_ARCH_HAS_CC_PLATFORM -- 2.25.1

2 1

[PATCH OLK-6.6] reserve space for enum cc_attr.
by liwei 02 Feb '24

02 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I90N74 -------------------------------- Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/cc_platform.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h index cb0d6cd1c12f..60d1879244af 100644 --- a/include/linux/cc_platform.h +++ b/include/linux/cc_platform.h @@ -12,6 +12,7 @@ #include <linux/types.h> #include <linux/stddef.h> +#include <linux/kabi.h> /** * enum cc_attr - Confidential computing attributes @@ -90,6 +91,11 @@ enum cc_attr { * Examples include TDX Guest. */ CC_ATTR_HOTPLUG_DISABLED, + + CC_ATTR_KABI_RES1, + CC_ATTR_KABI_RES2, + CC_ATTR_KABI_RES3, + CC_ATTR_KABI_RES4, }; #ifdef CONFIG_ARCH_HAS_CC_PLATFORM -- 2.25.1

2 1