- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] fs: don't audit the capability check in simple_xattr_list()
by Zizhi Wo 04 Dec '23

04 Dec '23

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v6.2-rc1 commit e7eda157c4071cd1e69f4b1687b0fbe1ae5e6f46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQI5?from=project-issue CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The check being unconditional may lead to unwanted denials reported by LSMs when a process has the capability granted by DAC, but denied by an LSM. In the case of SELinux such denials are a problem, since they can't be effectively filtered out via the policy and when not silenced, they produce noise that may hide a true problem or an attack. Checking for the capability only if any trusted xattr is actually present wouldn't really address the issue, since calling listxattr(2) on such node on its own doesn't indicate an explicit attempt to see the trusted xattrs. Additionally, it could potentially leak the presence of trusted xattrs to an unprivileged user if they can check for the denials (e.g. through dmesg). Therefore, it's best (and simplest) to keep the check unconditional and instead use ns_capable_noaudit() that will silence any associated LSM denials. Fixes: 38f38657444d ("xattr: extract simple_xattr code from tmpfs") Reported-by: Martin Pitt <mpitt(a)redhat.com> Suggested-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Reviewed-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Reviewed-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xattr.c b/fs/xattr.c index 470ee0af3200..5c3407e18e15 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -1012,7 +1012,7 @@ static int xattr_list_one(char **buffer, ssize_t *remaining_size, ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, char *buffer, size_t size) { - bool trusted = capable(CAP_SYS_ADMIN); + bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); struct simple_xattr *xattr; ssize_t remaining_size = size; int err = 0; -- 2.39.2

2 1

[PATCH OLK-6.6 V3 00/12] Add SDEI Watchdog Support
by Xiongfeng Wang 04 Dec '23

04 Dec '23

Xiongfeng Wang (12): firmware: arm_sdei: add interrupt binding api firmware: arm_sdei: make 'sdei_api_event_disable/enable' public lockup_detector: init lockup detector after all the init_calls watchdog: add nmi_watchdog support for arm64 based on SDEI sdei_watchdog: clear EOI of the secure timer before kdump sdei_watchdog: set secure timer period base on 'watchdog_thresh' sdei_watchdog: avoid possible false hardlockup init: only move down lockup_detector_init() when sdei_watchdog is enabled kprobes/arm64: Blacklist sdei watchdog callback functions openeuler_defconfig: Enable SDEI Watchdog stop_machine: mask sdei before running the callback arm64: kexec: only clear EOI for SDEI in NMI context arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/machine_kexec.c | 11 ++ arch/arm64/kernel/watchdog_sdei.c | 151 +++++++++++++++++++++++++ drivers/firmware/arm_sdei.c | 26 ++++- include/linux/arm_sdei.h | 5 + include/linux/nmi.h | 8 ++ include/uapi/linux/arm_sdei.h | 2 + init/main.c | 7 +- kernel/stop_machine.c | 10 ++ kernel/watchdog.c | 3 + lib/Kconfig.debug | 9 ++ 12 files changed, 232 insertions(+), 4 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_sdei.c -- 2.20.1

1 12

[PATCH OLK-5.10 0/6] bring mc support to page eject
by Wupeng Ma 04 Dec '23

04 Dec '23

From: Ma Wupeng <mawupeng1(a)huawei.com> During page eject, machine check safe is enhanced as follow: During soft offline page, page is copied to new page in kernel. If the origin page has UCE, there will lead to kernel panic. In order to solve this problem, use machine check safe to catch this error which can be achieved by using copy_mc_to_kernel to replace copy_page. Signal SIGBUS will be send to user task if this UCE is consumed by this situation to avoid kernel panic. Jiaqi Yan (1): mm/hwpoison: introduce copy_mc_highpage Ma Wupeng (5): mm/hwpoison: arm64: introduce copy_mc_highpage mm/hwpoison: introduce copy_mc_highpages mm/hwpoison: add migrate_page_mc_extra() mm: Update PF_COREDUMP_MCS to PF_MCS mm: page_eject: Add mc support during offline page arch/arm64/include/asm/page.h | 1 + arch/arm64/mm/copypage.c | 13 ++++++ drivers/ras/page_eject.c | 5 +++ fs/coredump.c | 4 +- include/linux/highmem.h | 52 +++++++++++++++++++++++ include/linux/sched.h | 2 +- lib/iov_iter.c | 2 +- mm/migrate.c | 77 +++++++++++++++++++++++++++++++---- 8 files changed, 143 insertions(+), 13 deletions(-) -- 2.25.1

2 7

[PATCH OLK-6.6 00/19] Add sharepool support
by Wang Wensheng 04 Dec '23

04 Dec '23

This patch series migrates share pool features from OLK-5.10 to OLK-6.6. We don't want to do this work patch by patch since there are hundreds of patches in OLK-5.10 including bugfix and small features generation. Instead we just take the final version and split it into a few small patches, each of which contains one feature at the final version. The share pool features is a big feature, it is mainly used to share user virtual memory for different processes in the same group. It could be used by this steps: Process A create a new group which is owned by process A. Process A add process B to the group. Process A add process C to the same group. Process B alloc a new memory VA, and write something in it. The VA was send to the process C by IPC, then process C got it. The process C access the VA and got the data directly. The process A could add more processes in the group to share the memory. Fix the memory by use the free function or exit the group. The new features is enabled both by CONFIG_SHARE_POOL and the enable_ascend_share_pool bootarg, it would not affect anything if disabled. Wang Wensheng (19): mm/hugetlb: Introduce hugetlb_insert_hugepage_pte[_by_pa] mm/vmalloc: Extend vmalloc usage about hugepage mm: Extend mmap assocated functions to accept mm_struct mm/sharepool: Add base framework for share_pool mm/sharepool: Add sp_area management code mm/sharepool: Reserve the va space for share_pool mm/sharepool: Implement mg_sp_make_share_u2k() mm/sharepool: Implement mg_sp_unshare_kva mm/sharepool: Implement mg_sp_walk_page_range() mm/sharepool: Implement mg_sp_free() mm/sharepool: Implement mg_sp_alloc() mm/sharepool: Implement mg_sp_make_share_k2u() mm/sharepool: Implement mg_sp_group_add_task() mm/sharepool: Implement mg_sp_group_id_by_pid() mm/sharepool: Implement mg_sp_id_of_current() mm/sharepool: Implement mg_sp_config_dvpp_range() mm/sharepool: Add proc interfaces to show sp info mm/sharepool: support fork() and exit() to handle the mm mm/sharepool: Protect the va reserved for sharepool include/linux/hugetlb.h | 32 + include/linux/mempolicy.h | 11 + include/linux/mm.h | 17 + include/linux/mm_types.h | 6 + include/linux/share_pool.h | 277 +++ include/linux/vmalloc.h | 18 + kernel/fork.c | 3 + mm/Kconfig | 34 + mm/Makefile | 1 + mm/gup.c | 23 +- mm/hugetlb.c | 78 + mm/mempolicy.c | 12 +- mm/mmap.c | 50 +- mm/mremap.c | 4 + mm/share_pool.c | 3450 ++++++++++++++++++++++++++++++++++++ mm/util.c | 4 + mm/vmalloc.c | 205 ++- 17 files changed, 4204 insertions(+), 21 deletions(-) create mode 100644 include/linux/share_pool.h create mode 100644 mm/share_pool.c -- 2.17.1

3 22

[PATCH OLK-5.10 0/6] bring mc support to page eject
by Wupeng Ma 04 Dec '23

04 Dec '23

From: Ma Wupeng <mawupeng1(a)huawei.com> During page eject, machine check safe is enhanced as follow: During soft offline page, page is copied to new page in kernel. If the origin page has UCE, there will lead to kernel panic. In order to solve this problem, use machine check safe to catch this error which can be achieved by using copy_mc_to_kernel to replace copy_page. Signal SIGBUS will be send to user task if this UCE is consumed by this situation to avoid kernel panic. Jiaqi Yan (1): mm/hwpoison: introduce copy_mc_highpage Ma Wupeng (5): mm/hwpoison: arm64: introduce copy_mc_highpage mm/hwpoison: introduce copy_mc_highpages mm/hwpoison: add migrate_page_mc_extra() mm: Update PF_COREDUMP_MCS to PF_MCS mm: page_eject: Add mc support during offline page arch/arm64/include/asm/page.h | 1 + arch/arm64/mm/copypage.c | 13 ++++++ drivers/ras/page_eject.c | 5 +++ fs/coredump.c | 4 +- include/linux/highmem.h | 52 +++++++++++++++++++++++ include/linux/sched.h | 2 +- lib/iov_iter.c | 2 +- mm/migrate.c | 77 +++++++++++++++++++++++++++++++---- 8 files changed, 143 insertions(+), 13 deletions(-) -- 2.25.1

1 6

[PATCH OLK-5.10 00/15] Some fixes and optimizations for hisi_sas
by Yihang Li 04 Dec '23

04 Dec '23

From: xiabing <xiabing12(a)h-partners.com> This patchset includes some changes for hisi_sas: - Fix NULL pointer issue when removing debugfs. - Directly calling register snapshot instead of workqueue. - Allocate debugfs memory during triggering debugfs dump. - Fix issue that device is not found because .phy_attached is not set. - Replace with standard error code return value. - Check the variable slot before use it. - Clear HISI_SAS_RESET_BIT, release hisi_hba semaphore, unblock the scsi host, clear HISI_SAS_REJECT_CMD_BIT if FLR failed. - Use the correct number of registers when reading register information. - Fix warnings detected by sparse - Handle the NCQ error returned by D2H frame Xiang Chen (1): scsi: hisi_sas: Remove unused variable and check in hisi_sas_send_ata_reset_each_phy() Xingui Yang (3): scsi: hisi_sas: Fix normally completed I/O analysed as failed scsi: hisi_sas: Fix warnings detected by sparse scsi: hisi_sas: Handle the NCQ error returned by D2H frame Yihang Li (11): scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs scsi: hisi_sas: Directly call register snapshot instead of using workqueue scsi: hisi_sas: Allocate DFX memory during dump trigger scsi: hisi_sas: Remove redundant checks for automatic debugfs dump scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM scsi: hisi_sas: Replace with standard error code return value scsi: hisi_sas: Check before using pointer variables scsi: hisi_sas: Rollback some operations if FLR failed scsi: hisi_sas: Correct the number of global debugfs registers scsi: hisi_sas: Fix the deadlock issue that occurs during automatic dump scsi: hisi_sas: Check whether debugfs is enabled before removing or releasing it drivers/scsi/hisi_sas/hisi_sas.h | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 37 ++++-- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 11 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 164 +++++++++++++------------ 4 files changed, 120 insertions(+), 95 deletions(-) -- 2.30.0

1 15

[PATCH OLK-5.10 0/2] Two bugfix patch about memcg swap qos
by Liu Shixin 04 Dec '23

04 Dec '23

Two bugfix patch about memcg swap qos. Liu Shixin (2): mm/swap_slots: fix out-of-bounds access of percpu area memcg: fix use-after-free of mm_struct mm/memcontrol.c | 4 ++++ mm/swap_slots.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 v4 0/2] ipvlan: Introduce l2e mode
by Zhengchao Shao 04 Dec '23

04 Dec '23

Inherited features of olk5.10 version. Keefe LIU (2): ipvlan: Introduce l2e mode ipvlan: Introduce local xmit queue for l2e mode drivers/net/Kconfig | 7 + drivers/net/ipvlan/ipvlan.h | 11 ++ drivers/net/ipvlan/ipvlan_core.c | 232 +++++++++++++++++++++++++++++++ drivers/net/ipvlan/ipvlan_main.c | 103 +++++++++++++- include/uapi/linux/if_link.h | 3 + 5 files changed, 354 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/5] xfs: fix some misc issue
by Long Li 04 Dec '23

04 Dec '23

This patch set fix some mics xfs issue: Long Li (5): xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean xfs: fix dir3 block read verify fail during log recover xfs: don't verify agf length when log recovery xfs: xfs_trans_cancel() path must check for log shutdown fs/xfs/libxfs/xfs_alloc.c | 3 ++- fs/xfs/xfs_buf.c | 5 +++++ fs/xfs/xfs_buf_item_recover.c | 9 +++------ fs/xfs/xfs_inode_item.c | 8 +++++++- fs/xfs/xfs_trans.c | 2 +- 5 files changed, 18 insertions(+), 9 deletions(-) -- 2.31.1

2 6

[PATCH OLK-5.10] fs: Fix error checking for d_hash_and_lookup()
by Zizhi Wo 04 Dec '23

04 Dec '23

From: Wang Ming <machel(a)vivo.com> mainline inclusion from mainline-v6.6-rc1 commit 0d5a4f8f775ff990142cdc810a84eae078589d27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LNLY?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The d_hash_and_lookup() function returns error pointers or NULL. Most incorrect error checks were fixed, but the one in int path_pts() was forgotten. Fixes: eedf265aa003 ("devpts: Make each mount of devpts an independent filesystem.") Signed-off-by: Wang Ming <machel(a)vivo.com> Message-Id: <20230713120555.7025-1-machel(a)vivo.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/namei.c b/fs/namei.c index ff140e2943a0..3588e12d6130 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -2647,7 +2647,7 @@ int path_pts(struct path *path) dput(path->dentry); path->dentry = parent; child = d_hash_and_lookup(parent, &this); - if (!child) + if (IS_ERR_OR_NULL(child)) return -ENOENT; path->dentry = child; -- 2.39.2

2 1