September 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ipv6: fix possible UAF in ip6_finish_output2()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.48 commit 6ab6bf731354a6fdbaa617d1ec194960db61cf3b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO CVE: CVE-2024-44986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit da273b377ae0d9bd255281ed3c2adb228321687b ] If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Vasily Averin <vasily.averin(a)linux.dev> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index db8d0e1..888b380 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -70,11 +70,15 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * /* Be paranoid, rather than too clever. */ if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) { + /* Make sure idev stays alive */ + rcu_read_lock(); skb = skb_expand_head(skb, hh_len); if (!skb) { IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); } hdr = ipv6_hdr(skb); -- 2.9.5

2 1

[PATCH OLK-5.10] ipv6: fix possible UAF in ip6_finish_output2()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.11-rc5 commit da273b377ae0d9bd255281ed3c2adb228321687b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO CVE: CVE-2024-44986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Vasily Averin <vasily.averin(a)linux.dev> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ip6_output.c [The conflict occurs because the commit e415ed3a4b8b ipv6: use skb_expand_head in ip6_finish_output2") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6d9571cb..153e906 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -81,6 +81,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } skb = nskb; } + /* Make sure idev stays alive */ + rcu_read_lock(); if (skb && pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { kfree_skb(skb); @@ -88,8 +90,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } if (!skb) { IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); } if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-44988
by Zhang Changzhong 12 Sep '24

12 Sep '24

fix CVE-2024-44988 Hans J. Schultz (1): net: dsa: mv88e6xxx: read FID when handling ATU violations Joseph Huang (1): net: dsa: mv88e6xxx: Fix out-of-bound access Vladimir Oltean (1): net: dsa: mv88e6xxx: replace ATU violation prints with trace points drivers/net/dsa/mv88e6xxx/Makefile | 4 ++ drivers/net/dsa/mv88e6xxx/global1_atu.c | 82 +++++++++++++++++++++++++++------ drivers/net/dsa/mv88e6xxx/trace.c | 6 +++ drivers/net/dsa/mv88e6xxx/trace.h | 66 ++++++++++++++++++++++++++ 4 files changed, 143 insertions(+), 15 deletions(-) create mode 100644 drivers/net/dsa/mv88e6xxx/trace.c create mode 100644 drivers/net/dsa/mv88e6xxx/trace.h -- 2.9.5

2 4

[PATCH OLK-6.6] net: dsa: mv88e6xxx: Fix out-of-bound access
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Joseph Huang <Joseph.Huang(a)garmin.com> stable inclusion from stable-v6.6.48 commit f7d8c2fabd39250cf2333fbf8eef67e837f90a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZQ CVE: CVE-2024-44988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 528876d867a23b5198022baf2e388052ca67c952 ] If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array). Fixes: 75c05a74e745 ("net: dsa: mv88e6xxx: Fix counting of ATU violations") Signed-off-by: Joseph Huang <Joseph.Huang(a)garmin.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20240819235251.1331763-1-Joseph.Huang@garmin.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/dsa/mv88e6xxx/global1_atu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c index ce3b369..c47f068 100644 --- a/drivers/net/dsa/mv88e6xxx/global1_atu.c +++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c @@ -457,7 +457,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id) trace_mv88e6xxx_atu_full_violation(chip->dev, spid, entry.portvec, entry.mac, fid); - chip->ports[spid].atu_full_violation++; + if (spid < ARRAY_SIZE(chip->ports)) + chip->ports[spid].atu_full_violation++; } return IRQ_HANDLED; -- 2.9.5

2 1

[PATCH OLK-5.10 0/3] fix CVE-2024-44988
by Zhang Changzhong 12 Sep '24

12 Sep '24

fix CVE-2024-44988 Hans J. Schultz (1): net: dsa: mv88e6xxx: read FID when handling ATU violations Joseph Huang (1): net: dsa: mv88e6xxx: Fix out-of-bound access Vladimir Oltean (1): net: dsa: mv88e6xxx: replace ATU violation prints with trace points drivers/net/dsa/mv88e6xxx/Makefile | 4 ++ drivers/net/dsa/mv88e6xxx/global1_atu.c | 82 +++++++++++++++++++++++++++------ drivers/net/dsa/mv88e6xxx/trace.c | 6 +++ drivers/net/dsa/mv88e6xxx/trace.h | 66 ++++++++++++++++++++++++++ 4 files changed, 143 insertions(+), 15 deletions(-) create mode 100644 drivers/net/dsa/mv88e6xxx/trace.c create mode 100644 drivers/net/dsa/mv88e6xxx/trace.h -- 2.9.5

2 4

[PATCH OLK-6.6] ipv6: prevent possible UAF in ip6_xmit()
by Zhang Changzhong 12 Sep '24

12 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.48 commit 124b428fe28064c809e4237b0b38e97200a8a4a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZA CVE: CVE-2024-44985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 2d5ff7e339d04622d8282661df36151906d0e1c7 ] If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF. Fixes: 0c9f227bee11 ("ipv6: use skb_expand_head in ip6_xmit") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Vasily Averin <vasily.averin(a)linux.dev> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index db8d0e1..290ca82 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -277,11 +277,15 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, head_room += opt->opt_nflen + opt->opt_flen; if (unlikely(head_room > skb_headroom(skb))) { + /* Make sure idev stays alive */ + rcu_read_lock(); skb = skb_expand_head(skb, head_room); if (!skb) { IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOBUFS; } + rcu_read_unlock(); } if (opt) { -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] x86/mtrr: Check if fixed MTRRs exist before saving them
by Zeng Heng 12 Sep '24

12 Sep '24

From: Andi Kleen <ak(a)linux.intel.com> stable inclusion from stable-v4.19.320 commit 34f36e6ee5bd7eff8b2adcd9fcaef369f752d82e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYQ CVE: CVE-2024-44948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 919f18f961c03d6694aa726c514184f2311a4614 upstream. MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this. Fixes: 2b1f6278d77c ("[PATCH] x86: Save the MTRRs of the BSP before booting an AP") Signed-off-by: Andi Kleen <ak(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240808000244.946864-1-ak@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.c b/arch/x86/kernel/cpu/mtrr/mtrr.c index 507039c20128..93ed6d3bf300 100644 --- a/arch/x86/kernel/cpu/mtrr/mtrr.c +++ b/arch/x86/kernel/cpu/mtrr/mtrr.c @@ -819,7 +819,7 @@ void mtrr_save_state(void) { int first_cpu; - if (!mtrr_enabled()) + if (!mtrr_enabled() || !mtrr_state.have_fixed) return; first_cpu = cpumask_first(cpu_online_mask); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] x86/mtrr: Check if fixed MTRRs exist before saving them
by Zeng Heng 12 Sep '24

12 Sep '24

From: Andi Kleen <ak(a)linux.intel.com> stable inclusion from stable-v5.10.224 commit 450b6b22acdaac67a18eaf5ed498421ffcf10051 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYQ CVE: CVE-2024-44948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 919f18f961c03d6694aa726c514184f2311a4614 upstream. MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this. Fixes: 2b1f6278d77c ("[PATCH] x86: Save the MTRRs of the BSP before booting an AP") Signed-off-by: Andi Kleen <ak(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240808000244.946864-1-ak@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.c b/arch/x86/kernel/cpu/mtrr/mtrr.c index 5f436cb4f7c4..9d5313118660 100644 --- a/arch/x86/kernel/cpu/mtrr/mtrr.c +++ b/arch/x86/kernel/cpu/mtrr/mtrr.c @@ -817,7 +817,7 @@ void mtrr_save_state(void) { int first_cpu; - if (!mtrr_enabled()) + if (!mtrr_enabled() || !mtrr_state.have_fixed) return; first_cpu = cpumask_first(cpu_online_mask); -- 2.25.1

2 1

[PATCH OLK-5.10] x86/mtrr: Check if fixed MTRRs exist before saving them
by Zeng Heng 12 Sep '24

12 Sep '24

From: Andi Kleen <ak(a)linux.intel.com> stable inclusion from stable-v5.10.224 commit 450b6b22acdaac67a18eaf5ed498421ffcf10051 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYQ CVE: CVE-2024-44948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 919f18f961c03d6694aa726c514184f2311a4614 upstream. MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this. Fixes: 2b1f6278d77c ("[PATCH] x86: Save the MTRRs of the BSP before booting an AP") Signed-off-by: Andi Kleen <ak(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240808000244.946864-1-ak@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.c b/arch/x86/kernel/cpu/mtrr/mtrr.c index 5f436cb4f7c4..9d5313118660 100644 --- a/arch/x86/kernel/cpu/mtrr/mtrr.c +++ b/arch/x86/kernel/cpu/mtrr/mtrr.c @@ -817,7 +817,7 @@ void mtrr_save_state(void) { int first_cpu; - if (!mtrr_enabled()) + if (!mtrr_enabled() || !mtrr_state.have_fixed) return; first_cpu = cpumask_first(cpu_online_mask); -- 2.25.1

2 1

[openeuler:OLK-5.10 5544/30000] include/trace/trace_events.h:27:23: warning: 'str__bonding__trace_system_name' defined but not used
by kernel test robot 12 Sep '24

12 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7c98201b2598a42ac2ce6a9036ee4e4349a406ac commit: b88ceab57674d2035d500a42901eb2e603e8f00c [5544/30000] drivers: hooks: add bonding driver vendor hooks config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240912/202409121219.ZxGnKcyP-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240912/202409121219.ZxGnKcyP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409121219.ZxGnKcyP-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/trace/define_trace.h:102, from include/trace/hooks/bonding.h:27, from drivers/hooks/vendor_hooks.c:11: >> include/trace/trace_events.h:27:23: warning: 'str__bonding__trace_system_name' defined but not used [-Wunused-const-variable=] 27 | #define __app__(x, y) str__##x##y | ^~~~~ include/trace/trace_events.h:28:21: note: in expansion of macro '__app__' 28 | #define __app(x, y) __app__(x, y) | ^~~~~~~ include/trace/trace_events.h:30:29: note: in expansion of macro '__app' 30 | #define TRACE_SYSTEM_STRING __app(TRACE_SYSTEM_VAR,__trace_system_name) | ^~~~~ include/trace/trace_events.h:33:27: note: in expansion of macro 'TRACE_SYSTEM_STRING' 33 | static const char TRACE_SYSTEM_STRING[] = \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:36:1: note: in expansion of macro 'TRACE_MAKE_SYSTEM_STR' 36 | TRACE_MAKE_SYSTEM_STR(); | ^~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/str__bonding__trace_system_name +27 include/trace/trace_events.h acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 26) acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 @27) #define __app__(x, y) str__##x##y acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 28) #define __app(x, y) __app__(x, y) acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 29) :::::: The code at line 27 was first introduced by commit :::::: acd388fd3af350ab24c6ab6f19b83fc4a4f3aa60 tracing: Give system name a pointer :::::: TO: Steven Rostedt (Red Hat) <rostedt(a)goodmis.org> :::::: CC: Steven Rostedt <rostedt(a)goodmis.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0