April 2024 - Kernel - mailweb.openeuler.org

[OLK-6.6 00/12] Support hns roce DCA mode
by Chengchang Tang 10 Apr '24

10 Apr '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Support hns roce DCA mode. Chengchang Tang (12): RDMA/hns: Introduce DCA for RC QP RDMA/hns: Add method for shrinking DCA memory pool RDMA/hns: Configure DCA mode for the userspace QP RDMA/hns: Add method for attaching WQE buffer RDMA/hns: Setup the configuration of WQE addressing to QPC RDMA/hns: Add method to detach WQE buffer RDMA/hns: Add method to query WQE buffer's address RDMA/hns: Add DCA support for kernel space RDMA/hns: Add debugfs support for DCA RDMA/hns: Optimize user DCA perfermance by sharing DCA status RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode RDMA/hns: Fix DCA's dependence on ib_uverbs drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_dca.c | 1875 ++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_dca.h | 78 + drivers/infiniband/hw/hns/hns_roce_debugfs.c | 406 ++++ drivers/infiniband/hw/hns/hns_roce_debugfs.h | 19 + drivers/infiniband/hw/hns/hns_roce_device.h | 69 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 304 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 5 + drivers/infiniband/hw/hns/hns_roce_main.c | 196 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 12 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 197 +- include/uapi/rdma/hns-abi.h | 73 +- 12 files changed, 3099 insertions(+), 137 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.h -- 2.30.0

1 12

[PATCH OLK-5.10 0/1] fixup CVE-2024-26751
by Yuntao Liu 10 Apr '24

10 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10] fbdev: savage: Error out if pixclock equals zero
by Cai Xinchen 10 Apr '24

10 Apr '24

From: Fullway Wang <fullwaywang(a)outlook.com> stable inclusion from stable-v5.10.211 commit 512ee6d6041e007ef5bf200c6e388e172a2c5b24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y8 CVE: CVE-2024-26778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang <fullwaywang(a)outlook.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index 0ac750cc5ea1..94ebd8af50cf 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -868,6 +868,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var, DBG("savagefb_check_var"); + if (!var->pixclock) + return -EINVAL; + var->transp.offset = 0; var->transp.length = 0; switch (var->bits_per_pixel) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH openEuler-22.03-LTS 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH OLK-5.10 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH OLK-5.10 0/1] fixup CVE-2024-26751
by Yuntao Liu 10 Apr '24

10 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

1 1

[PATCH openEuler-1.0-LTS] btrfs: dev-replace: properly validate device names
by Long Li 10 Apr '24

10 Apr '24

From: David Sterba <dsterba(a)suse.com> stable inclusion from stable-v4.19.273 commit 11d7a2e429c02d51e2dc90713823ea8b8d3d3a84 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E469 CVE: CVE-2024-26791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9845664b9ee47ce7ee7ea93caf47d39a9d4552c4 upstream. There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links). Link: https://lore.kernel.org/linux-btrfs/000000000000d1a1d1060cc9c5e7@google.com/ Link: https://lore.kernel.org/linux-btrfs/tencent_44CA0665C9836EF9EEC80CB9E7E206D… CC: stable(a)vger.kernel.org # 4.19+ CC: Edward Adam Davis <eadavis(a)qq.com> Reported-and-tested-by: syzbot+33f23b49ac24f986c9e8(a)syzkaller.appspotmail.com Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/dev-replace.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index 1b9c8ffb038f..c50c0251fd90 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -513,6 +513,23 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; } +static int btrfs_check_replace_dev_names(struct btrfs_ioctl_dev_replace_args *args) +{ + if (args->start.srcdevid == 0) { + if (memchr(args->start.srcdev_name, 0, + sizeof(args->start.srcdev_name)) == NULL) + return -ENAMETOOLONG; + } else { + args->start.srcdev_name[0] = 0; + } + + if (memchr(args->start.tgtdev_name, 0, + sizeof(args->start.tgtdev_name)) == NULL) + return -ENAMETOOLONG; + + return 0; +} + int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, struct btrfs_ioctl_dev_replace_args *args) { @@ -525,10 +542,9 @@ int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, default: return -EINVAL; } - - if ((args->start.srcdevid == 0 && args->start.srcdev_name[0] == '\0') || - args->start.tgtdev_name[0] == '\0') - return -EINVAL; + ret = btrfs_check_replace_dev_names(args); + if (ret < 0) + return ret; ret = btrfs_dev_replace_start(fs_info, args->start.tgtdev_name, args->start.srcdevid, -- 2.31.1

2 1

[PATCH OLK-5.10 0/1] fixup CVE-2024-26751
by Yuntao Liu 10 Apr '24

10 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

1 1