July 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ax25: Fix reference count leak issue of net_device
by Zhengchao Shao 03 Jul '24

03 Jul '24

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v6.6.33 commit 965d940fb7414b310a22666503d2af69459c981b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SG4 CVE: CVE-2024-38554 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 36e56b1b002bb26440403053f19f9e1a8bc075b2 ] There is a reference count leak issue of the object "net_device" in ax25_dev_device_down(). When the ax25 device is shutting down, the ax25_dev_device_down() drops the reference count of net_device one or zero times depending on if we goto unlock_put or not, which will cause memory leak. In order to solve the above issue, decrease the reference count of net_device after dev->ax25_ptr is set to null. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/7ce3b23a40d9084657ba1125432f0ecc380cbc80.17152470… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/ax25/ax25_dev.c [The conflict occurs because the commit a7d6e36b9ad0("ax25: Use kernel universal linked list to implement ax25_dev_list") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ax25/ax25_dev.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c index 282ec581c072..6f4ccb735653 100644 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -128,10 +128,6 @@ void ax25_dev_device_down(struct net_device *dev) s = s->next; } - spin_unlock_bh(&ax25_dev_lock); - dev->ax25_ptr = NULL; - ax25_dev_put(ax25_dev); - return; unlock_put: spin_unlock_bh(&ax25_dev_lock); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ftrace: Fix rcu warn in ftrace_location()
by Zheng Yejian 03 Jul '24

03 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAA3U5 CVE: NA --------------------------- Lockdep report that: WARNING: suspicious RCU usage ./include/linux/rcupdate.h:625 rcu_read_lock() used illegally while idle! other info that might help us debug this: RCU used illegally from idle CPU! rcu_scheduler_active = 2, debug_locks = 1 RCU used illegally from extended quiescent state! 1 lock held by swapper/0/0: #0: 000000003f648ecc (rcu_read_lock){....}, at: ftrace_location_range+0x0/0x400 kernel/trace/ftrace.c:1326 [...] Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x125/0x1ae lib/dump_stack.c:117 rcu_read_lock include/linux/rcupdate.h:624 [inline] ftrace_location_range+0x2e4/0x400 kernel/trace/ftrace.c:1613 ftrace_int3_handler+0x47/0x220 arch/x86/kernel/ftrace.c:304 do_int3+0x1d2/0x260 arch/x86/kernel/traps.c:592 int3+0x33/0x40 arch/x86/entry/entry_64.S:1170 [...] default_idle_call+0x3c/0x60 kernel/sched/idle.c:95 cpuidle_idle_call kernel/sched/idle.c:155 [inline] do_idle+0x28a/0x380 kernel/sched/idle.c:257 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:363 start_kernel+0x8bc/0x8fb init/main.c:744 secondary_startup_64+0xb7/0xc0 arch/x86/kernel/head_64.S:243 When function tracer is enabling, an 'int3' will be put at the fentry location of traced function, and before the fentry location being fully replaced as ftrace caller, any calls to the traced function will first redirect to call ftrace caller through ftrace_int3_handler(). When the traced function is called by idle task and rcu_read_lock() is indirectly called in ftrace_int3_handler(), then lockdep will warn that is illegal. RCU lock is not needed when ftrace_location() is called by ftrace_int3_handler() because that is an atomic context, so add in_atomic() check before hold or release RCU lock. Fixes: 85b642bd0701 ("ftrace: Fix possible use-after-free issue in ftrace_location()") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/ftrace.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 6704150cb655..ad4440da5b78 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -1581,7 +1581,12 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) key.ip = start; key.flags = end; /* overload flags, as it is unsigned long */ - rcu_read_lock(); + /* + * It is in atomic context when called from ftrace_int3_handler(), + * in this case rcu lock is not needed. + */ + if (!in_atomic()) + rcu_read_lock(); for (pg = ftrace_pages_start; pg; pg = pg->next) { if (pg->index == 0 || end < pg->records[0].ip || @@ -1595,7 +1600,8 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) break; } } - rcu_read_unlock(); + if (!in_atomic()) + rcu_read_unlock(); return ip; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/7] CVE-2024-38622
by Yongqiang Liu 03 Jul '24

03 Jul '24

Aleksandr Mishin (1): drm/msm/dpu: Add callback function pointer check before its call Dmitry Baryshkov (6): drm/msm/dpu: remove irq_idx argument from IRQ callbacks drm/msm/dpu: extract dpu_core_irq_is_valid() helper drm/msm/dpu: add helper to get IRQ-related data drm/msm/dpu: make the irq table size static drm/msm/dpu: stop using raw IRQ indices in the kernel output drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.h | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 30 ++-- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 2 +- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 8 +- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 4 +- .../drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 16 +-- .../gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 131 +++++++++++------- .../gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.h | 18 ++- 8 files changed, 119 insertions(+), 92 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6] tls: fix missing memory barrier in tls_init
by Liu Jian 03 Jul '24

03 Jul '24

From: "Dae R. Jeong" <threeearcat(a)gmail.com> stable inclusion from stable-v6.6.33 commit ab67c2fd3d070a21914d0c31319d3858ab4e199c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D88 CVE: CVE-2024-36489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 91e61dd7a0af660408e87372d8330ceb218be302 ] In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt() -(3) In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference. To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot. Fixes: d5bee7374b68 ("net/tls: Annotate access to sk_prot with READ_ONCE/WRITE_ONCE") Signed-off-by: Yewon Choi <woni9911(a)gmail.com> Signed-off-by: Dae R. Jeong <threeearcat(a)gmail.com> Link: https://lore.kernel.org/netdev/ZU4OJG56g2V9z_H7@dragonet/T/ Link: https://lore.kernel.org/r/Zkx4vjSFp0mfpjQ2@libra05 Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/tls/tls_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index e97fcb502115..0a67b93a52ec 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -814,9 +814,17 @@ struct tls_context *tls_ctx_create(struct sock *sk) return NULL; mutex_init(&ctx->tx_lock); - rcu_assign_pointer(icsk->icsk_ulp_data, ctx); ctx->sk_proto = READ_ONCE(sk->sk_prot); ctx->sk = sk; + /* Release semantic of rcu_assign_pointer() ensures that + * ctx->sk_proto is visible before changing sk->sk_prot in + * update_sk_prot(), and prevents reading uninitialized value in + * tls_{getsockopt, setsockopt}. Note that we do not need a + * read barrier in tls_{getsockopt,setsockopt} as there is an + * address dependency between sk->sk_proto->{getsockopt,setsockopt} + * and ctx->sk_proto. + */ + rcu_assign_pointer(icsk->icsk_ulp_data, ctx); return ctx; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tls: fix missing memory barrier in tls_init
by Liu Jian 03 Jul '24

03 Jul '24

From: "Dae R. Jeong" <threeearcat(a)gmail.com> stable inclusion from stable-v5.10.219 commit d72e126e9a36d3d33889829df8fc90100bb0e071 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D88 CVE: CVE-2024-36489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 91e61dd7a0af660408e87372d8330ceb218be302 ] In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt() -(3) In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference. To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot. Fixes: d5bee7374b68 ("net/tls: Annotate access to sk_prot with READ_ONCE/WRITE_ONCE") Signed-off-by: Yewon Choi <woni9911(a)gmail.com> Signed-off-by: Dae R. Jeong <threeearcat(a)gmail.com> Link: https://lore.kernel.org/netdev/ZU4OJG56g2V9z_H7@dragonet/T/ Link: https://lore.kernel.org/r/Zkx4vjSFp0mfpjQ2@libra05 Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/tls/tls_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 9d2254b2879d..ed30ab0bf1b8 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -674,9 +674,17 @@ struct tls_context *tls_ctx_create(struct sock *sk) return NULL; mutex_init(&ctx->tx_lock); - rcu_assign_pointer(icsk->icsk_ulp_data, ctx); ctx->sk_proto = READ_ONCE(sk->sk_prot); ctx->sk = sk; + /* Release semantic of rcu_assign_pointer() ensures that + * ctx->sk_proto is visible before changing sk->sk_prot in + * update_sk_prot(), and prevents reading uninitialized value in + * tls_{getsockopt, setsockopt}. Note that we do not need a + * read barrier in tls_{getsockopt,setsockopt} as there is an + * address dependency between sk->sk_proto->{getsockopt,setsockopt} + * and ctx->sk_proto. + */ + rcu_assign_pointer(icsk->icsk_ulp_data, ctx); return ctx; } -- 2.34.1

2 1

[PATCH OLK-5.10] tls: fix missing memory barrier in tls_init
by Liu Jian 03 Jul '24

03 Jul '24

From: "Dae R. Jeong" <threeearcat(a)gmail.com> stable inclusion from stable-v5.10.219 commit d72e126e9a36d3d33889829df8fc90100bb0e071 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D88 CVE: CVE-2024-36489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 91e61dd7a0af660408e87372d8330ceb218be302 ] In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt() -(3) In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference. To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot. Fixes: d5bee7374b68 ("net/tls: Annotate access to sk_prot with READ_ONCE/WRITE_ONCE") Signed-off-by: Yewon Choi <woni9911(a)gmail.com> Signed-off-by: Dae R. Jeong <threeearcat(a)gmail.com> Link: https://lore.kernel.org/netdev/ZU4OJG56g2V9z_H7@dragonet/T/ Link: https://lore.kernel.org/r/Zkx4vjSFp0mfpjQ2@libra05 Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/tls/tls_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index b82c54cc3daf..3d6a4685ed60 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -708,9 +708,17 @@ struct tls_context *tls_ctx_create(struct sock *sk) return NULL; mutex_init(&ctx->tx_lock); - rcu_assign_pointer(icsk->icsk_ulp_data, ctx); ctx->sk_proto = READ_ONCE(sk->sk_prot); ctx->sk = sk; + /* Release semantic of rcu_assign_pointer() ensures that + * ctx->sk_proto is visible before changing sk->sk_prot in + * update_sk_prot(), and prevents reading uninitialized value in + * tls_{getsockopt, setsockopt}. Note that we do not need a + * read barrier in tls_{getsockopt,setsockopt} as there is an + * address dependency between sk->sk_proto->{getsockopt,setsockopt} + * and ctx->sk_proto. + */ + rcu_assign_pointer(icsk->icsk_ulp_data, ctx); return ctx; } -- 2.34.1

2 1

[PATCH v3 openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-38567
by Li Huafei 03 Jul '24

03 Jul '24

Alan Stern (1): USB: core: Add routines for endpoint checks in old drivers Nikita Zhandarovich (1): wifi: carl9170: add a proper sanity check for endpoints drivers/net/wireless/ath/carl9170/usb.c | 32 +++++++++++ drivers/usb/core/usb.c | 76 +++++++++++++++++++++++++ include/linux/usb.h | 5 ++ 3 files changed, 113 insertions(+) -- 2.25.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 03 Jul '24

03 Jul '24

您好！ Kernel 邀请您参加 2024-07-05 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议纪要看板申报）会议链接：https://meeting.huaweicloud.com:36443/#/j/980862324 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-07-05 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议纪要看板申报） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/980862324. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nilfs2: fix potential kernel bug due to lack of writeback flag waiting
by dinglongwei 02 Jul '24

02 Jul '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.1.95 commit 271dcd977ccda8c7a26e360425ae7b4db7d2ecc0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AE5 CVE: CVE-2024-37078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a4ca369ca221bb7e06c725792ac107f0e48e82e7 upstream. Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state. Link: https://lkml.kernel.org/r/20240530141556.4411-1-konishi.ryusuke@gmail.com Fixes: 9ff05123e3bf ("nilfs2: segment constructor") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- fs/nilfs2/segment.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 808fb628577d..53f2d69fabbd 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1658,6 +1658,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh->b_page != bd_page) { if (bd_page) { lock_page(bd_page); + wait_on_page_writeback(bd_page); clear_page_dirty_for_io(bd_page); set_page_writeback(bd_page); unlock_page(bd_page); @@ -1671,6 +1672,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) if (bh == segbuf->sb_super_root) { if (bh->b_page != bd_page) { lock_page(bd_page); + wait_on_page_writeback(bd_page); clear_page_dirty_for_io(bd_page); set_page_writeback(bd_page); unlock_page(bd_page); @@ -1687,6 +1689,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } if (bd_page) { lock_page(bd_page); + wait_on_page_writeback(bd_page); clear_page_dirty_for_io(bd_page); set_page_writeback(bd_page); unlock_page(bd_page); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] fix uaf when proc_cpuset_show
by Chen Ridong 02 Jul '24

02 Jul '24

*** BLURB HERE *** Chen Ridong (1): cgroup: fix uaf when proc_cpuset_show kernel/cgroup/cpuset.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) -- 2.34.1

2 2