April 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS 0/1] fixup CVE-2024-26908
by Yuntao Liu 24 Apr '24

24 Apr '24

fixup CVE-2024-26908 Kunwu Chan (1): x86/xen: Add some null pointer checking to smp.c arch/x86/xen/smp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-26865
by Zhengchao Shao 24 Apr '24

24 Apr '24

fix CVE-2024-26865. Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): tcp: Clean up kernel listener's reqsk in inet_twsk_purge() net/ipv4/inet_timewait_sock.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-26865
by Zhengchao Shao 24 Apr '24

24 Apr '24

fix CVE-2024-26865. Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): tcp: Clean up kernel listener's reqsk in inet_twsk_purge() net/ipv4/inet_timewait_sock.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-26865
by Zhengchao Shao 24 Apr '24

24 Apr '24

fix CVE-2024-26865. Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): tcp: Clean up kernel listener's reqsk in inet_twsk_purge() net/ipv4/inet_timewait_sock.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS 0/1] fixup CVE-2024-26908
by Yuntao Liu 24 Apr '24

24 Apr '24

fixup CVE-2024-26908 Kunwu Chan (1): x86/xen: Add some null pointer checking to smp.c arch/x86/xen/smp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] fixup CVE-2024-26908
by Yuntao Liu 24 Apr '24

24 Apr '24

fixup CVE-2024-26908 Kunwu Chan (1): x86/xen: Add some null pointer checking to smp.c arch/x86/xen/smp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10] mm/mmap: fix memory leak in mmap_region()
by Tong Tiangen 24 Apr '24

24 Apr '24

From: Li Zetao <lizetao1(a)huawei.com> mainline inclusion from mainline-v6.1-rc5 commit d4af56c5c7c6781ca6ca8075e2cf5bc119ed33d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9J6XR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a memory leak reported by kmemleak: unreferenced object 0xffff88817231ce40 (size 224): comm "mount.cifs", pid 19308, jiffies 4295917571 (age 405.880s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 60 c0 b2 00 81 88 ff ff 98 83 01 42 81 88 ff ff `..........B.... backtrace: [<ffffffff81936171>] __alloc_file+0x21/0x250 [<ffffffff81937051>] alloc_empty_file+0x41/0xf0 [<ffffffff81937159>] alloc_file+0x59/0x710 [<ffffffff81937964>] alloc_file_pseudo+0x154/0x210 [<ffffffff81741dbf>] __shmem_file_setup+0xff/0x2a0 [<ffffffff817502cd>] shmem_zero_setup+0x8d/0x160 [<ffffffff817cc1d5>] mmap_region+0x1075/0x19d0 [<ffffffff817cd257>] do_mmap+0x727/0x1110 [<ffffffff817518b2>] vm_mmap_pgoff+0x112/0x1e0 [<ffffffff83adf955>] do_syscall_64+0x35/0x80 [<ffffffff83c0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 The root cause was traced to an error handing path in mmap_region() when arch_validate_flags() or mas_preallocate() fails. In the shared anonymous mapping sence, vma will be setuped and mapped with a new shared anonymous file via shmem_zero_setup(). So in this case, the file resource needs to be released. Fix it by calling fput(vma->vm_file) and unmap_region() when arch_validate_flags() or mas_preallocate() returns an error in the shared anonymous mapping sence. Link: https://lkml.kernel.org/r/20221028073717.1179380-1-lizetao1@huawei.com Fixes: d4af56c5c7c6 ("mm: start tracking VMAs with maple tree") Fixes: c462ac288f2c ("mm: Introduce arch_validate_flags()") Signed-off-by: Li Zetao <lizetao1(a)huawei.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> conflicts: mm/mmap.c Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/mmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mm/mmap.c b/mm/mmap.c index bddd7f0f88b9..7a70757f4008 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1914,6 +1914,8 @@ static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, error = -EINVAL; if (file) goto close_and_free_vma; + else if (vma->vm_file) + goto unmap_and_free_vma; else goto free_vma; } @@ -1967,7 +1969,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, /* Undo any partial mapping done by a device driver. */ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); - if (vm_flags & VM_SHARED) + if (file && (vm_flags & VM_SHARED)) mapping_unmap_writable(file->f_mapping); allow_write_and_free_vma: if (vm_flags & VM_DENYWRITE) -- 2.25.1

2 5

[PATCH OLK-5.10] mm/mmap: fix memory leak in mmap_region()
by Tong Tiangen 24 Apr '24

24 Apr '24

From: Li Zetao <lizetao1(a)huawei.com> mainline inclusion from mainline-v6.1-rc5 commit d4af56c5c7c6781ca6ca8075e2cf5bc119ed33d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9J6XR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a memory leak reported by kmemleak: unreferenced object 0xffff88817231ce40 (size 224): comm "mount.cifs", pid 19308, jiffies 4295917571 (age 405.880s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 60 c0 b2 00 81 88 ff ff 98 83 01 42 81 88 ff ff `..........B.... backtrace: [<ffffffff81936171>] __alloc_file+0x21/0x250 [<ffffffff81937051>] alloc_empty_file+0x41/0xf0 [<ffffffff81937159>] alloc_file+0x59/0x710 [<ffffffff81937964>] alloc_file_pseudo+0x154/0x210 [<ffffffff81741dbf>] __shmem_file_setup+0xff/0x2a0 [<ffffffff817502cd>] shmem_zero_setup+0x8d/0x160 [<ffffffff817cc1d5>] mmap_region+0x1075/0x19d0 [<ffffffff817cd257>] do_mmap+0x727/0x1110 [<ffffffff817518b2>] vm_mmap_pgoff+0x112/0x1e0 [<ffffffff83adf955>] do_syscall_64+0x35/0x80 [<ffffffff83c0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 The root cause was traced to an error handing path in mmap_region() when arch_validate_flags() or mas_preallocate() fails. In the shared anonymous mapping sence, vma will be setuped and mapped with a new shared anonymous file via shmem_zero_setup(). So in this case, the file resource needs to be released. Fix it by calling fput(vma->vm_file) and unmap_region() when arch_validate_flags() or mas_preallocate() returns an error in the shared anonymous mapping sence. Link: https://lkml.kernel.org/r/20221028073717.1179380-1-lizetao1@huawei.com Fixes: d4af56c5c7c6 ("mm: start tracking VMAs with maple tree") Fixes: c462ac288f2c ("mm: Introduce arch_validate_flags()") Signed-off-by: Li Zetao <lizetao1(a)huawei.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> conflicts: mm/mmap.c Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/mmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mm/mmap.c b/mm/mmap.c index bddd7f0f88b9..7a70757f4008 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1914,6 +1914,8 @@ static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, error = -EINVAL; if (file) goto close_and_free_vma; + else if (vma->vm_file) + goto unmap_and_free_vma; else goto free_vma; } @@ -1967,7 +1969,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, /* Undo any partial mapping done by a device driver. */ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); - if (vm_flags & VM_SHARED) + if (file && (vm_flags & VM_SHARED)) mapping_unmap_writable(file->f_mapping); allow_write_and_free_vma: if (vm_flags & VM_DENYWRITE) -- 2.25.1

2 5

[openeuler:openEuler-1.0-LTS 20368/22178] drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 24 Apr '24

24 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b3e8831fccd1999bb3d13b324fce51dcf3d41841 commit: d549e609b8685eb101a4653249ef7e3fe8bb3e99 [20368/22178] binder: use userspace pointer as base of buffer space config: x86_64-randconfig-123-20240424 (https://download.01.org/0day-ci/archive/20240424/202404241104.lionv8rg-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240424/202404241104.lionv8rg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404241104.lionv8rg-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *page_addr @@ got void [noderef] <asn:1> *user_data @@ drivers/android/binder_alloc_selftest.c:109:19: sparse: expected void *page_addr drivers/android/binder_alloc_selftest.c:109:19: sparse: got void [noderef] <asn:1> *user_data drivers/android/binder_alloc_selftest.c:111:41: sparse: sparse: subtraction of different types can't work (different address spaces) drivers/android/binder_alloc_selftest.c:85: warning: Enum value 'LOOP_END' not described in enum 'buf_end_align_type' vim +109 drivers/android/binder_alloc_selftest.c 100 101 static bool check_buffer_pages_allocated(struct binder_alloc *alloc, 102 struct binder_buffer *buffer, 103 size_t size) 104 { 105 void *page_addr, *end; 106 int page_index; 107 108 end = (void *)PAGE_ALIGN((uintptr_t)buffer->user_data + size); > 109 page_addr = buffer->user_data; 110 for (; page_addr < end; page_addr += PAGE_SIZE) { 111 page_index = (page_addr - alloc->buffer) / PAGE_SIZE; 112 if (!alloc->pages[page_index].page_ptr || 113 !list_empty(&alloc->pages[page_index].lru)) { 114 pr_err("expect alloc but is %s at page index %d\n", 115 alloc->pages[page_index].page_ptr ? 116 "lru" : "free", page_index); 117 return false; 118 } 119 } 120 return true; 121 } 122 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/3] CVE-2024-26907
by Ziyang Xuan 24 Apr '24

24 Apr '24

Patchset of CVE-2024-26907. v2: - Add new bugfix patch for patch 1. Alexey Dobriyan (1): uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ Kees Cook (1): [Backport] stddef: Introduce DECLARE_FLEX_ARRAY() helper Leon Romanovsky (1): RDMA/mlx5: Fix fortify source warning while accessing Eth segment drivers/infiniband/hw/mlx5/wr.c | 2 +- include/linux/mlx5/qp.h | 5 ++++- include/linux/stddef.h | 13 +++++++++++++ include/uapi/linux/stddef.h | 23 +++++++++++++++++++++++ scripts/kernel-doc | 3 ++- 5 files changed, 43 insertions(+), 3 deletions(-) -- 2.25.1

2 4