August 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
by Long Li 27 Aug '24

27 Aug '24

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v5.15.164 commit 0484adcb5fbcadd9ba0fd4485c42630f72e97da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPVC CVE: CVE-2024-42299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 2fef55d8f78383c8e6d6d4c014b9597375132696 upstream. If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->page_size - page_off" will get a negative value in the later read_log_page(). Cc: stable(a)vger.kernel.org Fixes: b46acd6a6a627d876898e ("fs/ntfs3: Add NTFS journal") Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ntfs3/fslog.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index f78aa66313d2..fb56c4c33987 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -3953,6 +3953,9 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) goto out; } + log->page_mask = log->page_size - 1; + log->page_bits = blksize_bits(log->page_size); + /* If the file size has shrunk then we won't mount it. */ if (l_size < le64_to_cpu(ra2->l_size)) { err = -EINVAL; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
by Long Li 27 Aug '24

27 Aug '24

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v5.15.164 commit 0484adcb5fbcadd9ba0fd4485c42630f72e97da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPVC CVE: CVE-2024-42299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 2fef55d8f78383c8e6d6d4c014b9597375132696 upstream. If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->page_size - page_off" will get a negative value in the later read_log_page(). Cc: stable(a)vger.kernel.org Fixes: b46acd6a6a627d876898e ("fs/ntfs3: Add NTFS journal") Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ntfs3/fslog.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index f78aa66313d2..fb56c4c33987 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -3953,6 +3953,9 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) goto out; } + log->page_mask = log->page_size - 1; + log->page_bits = blksize_bits(log->page_size); + /* If the file size has shrunk then we won't mount it. */ if (l_size < le64_to_cpu(ra2->l_size)) { err = -EINVAL; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] tcp: fix race in tcp_v6_syn_recv_sock()
by Yue Haibing 27 Aug '24

27 Aug '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.317 commit 06f208ae0670ef97b0bf253a5523863e113026b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMPH5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit d37fe4255abe8e7b419b90c5847e8ec2b8debb08 ] tcp_v6_syn_recv_sock() calls ip6_dst_store() before inet_sk(newsk)->pinet6 has been set up. This means ip6_dst_store() writes over the parent (listener) np->dst_cookie. This is racy because multiple threads could share the same parent and their final np->dst_cookie could be wrong. Move ip6_dst_store() call after inet_sk(newsk)->pinet6 has been changed and after the copy of parent ipv6_pinfo. Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv6/tcp_ipv6.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index e3878cf00dd4..4d9c9fbef8b9 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1176,7 +1176,6 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * */ newsk->sk_gso_type = SKB_GSO_TCPV6; - ip6_dst_store(newsk, dst, NULL, NULL); inet6_sk_rx_dst_set(newsk, skb); newtcp6sk = (struct tcp6_sock *)newsk; @@ -1188,6 +1187,8 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * memcpy(newnp, np, sizeof(struct ipv6_pinfo)); + ip6_dst_store(newsk, dst, NULL, NULL); + newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr; newnp->saddr = ireq->ir_v6_loc_addr; newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] net: Backport lts-4.19 patches
by Dong Chenchen 27 Aug '24

27 Aug '24

backport lts-4.19 patches. Eric Dumazet (1): af_packet: do not call packet_read_pending() from tpacket_destruct_skb() Qingfang DENG (1): neighbour: fix unaligned access to pneigh_entry include/net/neighbour.h | 2 +- net/packet/af_packet.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/5] Bugfix patches for hns RoCE
by Chengchang Tang 27 Aug '24

27 Aug '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bugfix patches for hns roce. Chengchang Tang (4): RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS RDMA/hns: Fix possible RAS when DCA is not attached RDMA/hns: Fix a meaningless loop in active_dca_pages_proc() RDMA/hns: Fix list_*_careful() not being used in pairs Junxian Huang (1): RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler drivers/infiniband/hw/hns/hns_roce_dca.c | 60 +++++++++++++++++++-- drivers/infiniband/hw/hns/hns_roce_dca.h | 2 + drivers/infiniband/hw/hns/hns_roce_device.h | 3 ++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 ++-- drivers/infiniband/hw/hns/hns_roce_main.c | 12 +++++ drivers/infiniband/hw/hns/hns_roce_qp.c | 23 ++++++++ 6 files changed, 102 insertions(+), 7 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS v1 0/2] Backport bugfix for AMD SMN
by Wei Li 27 Aug '24

27 Aug '24

Backport bugfix for AMD SMN. Naveen Naidu (1): PCI: Add PCI_ERROR_RESPONSE and related definitions Yazen Ghannam (1): x86/amd_nb: Check for invalid SMN reads arch/x86/kernel/amd_nb.c | 9 ++++++++- include/linux/pci.h | 9 +++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] kobject_uevent: Fix OOB access within zap_modalias_env()
by Zhao Wenhui 27 Aug '24

27 Aug '24

From: Zijun Hu <quic_zijuhu(a)quicinc.com> mainline inclusion from mainline-v6.11-rc1 commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP CVE: CVE-2024-42292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove. Fixes: 9b3fa47d4a76 ("kobject: fix suppressing modalias in uevents delivered over netlink") Cc: stable(a)vger.kernel.org Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Reviewed-by: Lk Sii <lk_sii(a)163.com> Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@qui… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- lib/kobject_uevent.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index b5fc7b9ce197..1af2e79b5c2d 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -430,8 +430,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) len = strlen(env->envp[i]) + 1; if (i != env->envp_idx - 1) { + /* @env->envp[] contains pointers to @env->buf[] + * with @env->buflen chars, and we are removing + * variable MODALIAS here pointed by @env->envp[i] + * with length @len as shown below: + * + * 0 @env->buf[] @env->buflen + * --------------------------------------------- + * ^ ^ ^ ^ + * | |-> @len <-| target block | + * @env->envp[0] @env->envp[i] @env->envp[i + 1] + * + * so the "target block" indicated above is moved + * backward by @len, and its right size is + * @env->buflen - (@env->envp[i + 1] - @env->envp[0]). + */ memmove(env->envp[i], env->envp[i + 1], - env->buflen - len); + env->buflen - (env->envp[i + 1] - env->envp[0])); for (j = i; j < env->envp_idx - 1; j++) env->envp[j] = env->envp[j + 1] - len; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Fix Mainline patchs
by Luo Gengkun 27 Aug '24

27 Aug '24

Breno Leitao (1): perf/x86/amd/core: Always clear status for idx Sandipan Das (1): perf/x86/amd/core: Fix overflow reset on hotplug arch/x86/events/amd/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2]
by Luo Gengkun 27 Aug '24

27 Aug '24

Breno Leitao (1): perf/x86/amd/core: Always clear status for idx Sandipan Das (1): perf/x86/amd/core: Fix overflow reset on hotplug arch/x86/events/amd/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/1] CVE-2024-42287
by Chen Ridong 27 Aug '24

27 Aug '24

CVE-2024-42287 Shreyas Deodhar (1): scsi: qla2xxx: Complete command early within lock drivers/scsi/qla2xxx/qla_os.c | 5 ----- 1 file changed, 5 deletions(-) -- 2.34.1

2 2