- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] mm: Add sysctl to clear free list pages
by Yu Liao 29 Dec '23

29 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8MK3O CVE: NA -------------------------------- This patch add sysctl to clear pages in free lists of each NUMA node. For each NUMA node, clear each page in the free list, these work is scheduled on a random CPU of the NUMA node. When kasan is enabled and the pages are free, the shadow memory will be filled with 0xFF, writing these free pages will cause UAF, so just disable KASAN for clear freelist. In the case of large memory, the clear freelist will hold zone lock for a long time. As a result, the process may be blocked unless clear freelist thread exit, and causing the system to be reset by the watchdog. Provide a mechanism to stop clear freelist threads when elapsed time exceeds cfp_timeout, which can be set by module_param(). Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- .../admin-guide/kernel-parameters.txt | 3 + Documentation/admin-guide/sysctl/vm.rst | 13 ++ mm/Kconfig | 12 ++ mm/Makefile | 2 + mm/clear_freelist_page.c | 178 ++++++++++++++++++ 5 files changed, 208 insertions(+) create mode 100644 mm/clear_freelist_page.c diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index fe2dc03538fe..14dda1178c34 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -620,6 +620,9 @@ Also note the kernel might malfunction if you disable some critical bits. + clear_freelist + Enable clear_freelist feature. + clk_ignore_unused [CLK] Prevents the clock framework from automatically gating diff --git a/Documentation/admin-guide/sysctl/vm.rst b/Documentation/admin-guide/sysctl/vm.rst index 2025b524028c..7c411b1dc3a9 100644 --- a/Documentation/admin-guide/sysctl/vm.rst +++ b/Documentation/admin-guide/sysctl/vm.rst @@ -25,6 +25,7 @@ files can be found in mm/swap.c. Currently, these files are in /proc/sys/vm: - admin_reserve_kbytes +- clear_freelist_pages - compact_memory - compaction_proactiveness - compact_unevictable_allowed @@ -110,6 +111,18 @@ On x86_64 this is about 128MB. Changing this takes effect whenever an application requests memory. +clear_freelist_pages +==================== + +Available only when CONFIG_CLEAR_FREELIST_PAGE is set. When 1 is written to the +file, all pages in free lists will be written with 0. + +Zone lock is held during clear_freelist_pages, if the execution time is too +long, RCU CPU Stall warnings will be print. For each NUMA node, +clear_freelist_pages is performed on a "random" CPU of the NUMA node. +The time consuming is related to the hardware. + + compact_memory ============== diff --git a/mm/Kconfig b/mm/Kconfig index df87fab46621..be9104ace232 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1336,6 +1336,18 @@ config PAGE_CACHE_LIMIT if unsure, say N to disable the PAGE_CACHE_LIMIT. +config CLEAR_FREELIST_PAGE + bool "Support for clear free list pages" + depends on MMU && SYSCTL + default n + help + Say y here to enable the clear free list pages feature. When + writing to clear_freelist, trigger to clean up the free memory + of the buddy system. + + To enable this feature, kernel parameter "clear_freelist" also + needs to be added. + source "mm/damon/Kconfig" endmenu diff --git a/mm/Makefile b/mm/Makefile index 07cf74abd241..6759053ed782 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -7,6 +7,7 @@ KASAN_SANITIZE_slab_common.o := n KASAN_SANITIZE_slab.o := n KASAN_SANITIZE_slub.o := n KCSAN_SANITIZE_kmemleak.o := n +KASAN_SANITIZE_clear_freelist_page.o := n # These produce frequent data race reports: most of them are due to races on # the same word but accesses to different bits of that word. Re-enable KCSAN @@ -142,3 +143,4 @@ obj-$(CONFIG_SHRINKER_DEBUG) += shrinker_debug.o obj-$(CONFIG_SHARE_POOL) += share_pool.o obj-$(CONFIG_MEMCG_MEMFS_INFO) += memcg_memfs_info.o obj-$(CONFIG_PAGE_CACHE_LIMIT) += page_cache_limit.o +obj-$(CONFIG_CLEAR_FREELIST_PAGE) += clear_freelist_page.o diff --git a/mm/clear_freelist_page.c b/mm/clear_freelist_page.c new file mode 100644 index 000000000000..96c8b464b8aa --- /dev/null +++ b/mm/clear_freelist_page.c @@ -0,0 +1,178 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Support for clear free list pages. + */ + +#include <linux/mmzone.h> +#include <linux/mm_types.h> +#include <linux/mm.h> +#include <linux/sysctl.h> +#include <linux/highmem.h> +#include <linux/slab.h> +#include <linux/workqueue.h> +#include <linux/sched.h> +#include <linux/atomic.h> +#include <linux/nmi.h> +#include <linux/sched/clock.h> +#include <linux/module.h> + +#define CFP_DEFAULT_TIMEOUT 2000 +#define for_each_populated_zone_pgdat(pgdat, zone) \ + for (zone = pgdat->node_zones; \ + zone; \ + zone = next_pgdat_zone(zone)) \ + if (!populated_zone(zone)) \ + ; /* do nothing */ \ + else + +struct pgdat_entry { + struct pglist_data *pgdat; + struct work_struct work; +}; + +static DECLARE_WAIT_QUEUE_HEAD(clear_freelist_wait); +static DEFINE_MUTEX(clear_freelist_lock); +static atomic_t clear_freelist_workers; +static atomic_t clear_pages_num; +static ulong cfp_timeout_ms = CFP_DEFAULT_TIMEOUT; + +/* + * next_pgdat_zone - helper magic for for_each_populated_zone_pgdat() + */ +static struct zone *next_pgdat_zone(struct zone *zone) +{ + pg_data_t *pgdat = zone->zone_pgdat; + + if (zone < pgdat->node_zones + MAX_NR_ZONES - 1) + zone++; + else + zone = NULL; + return zone; +} + +static void clear_pgdat_freelist_pages(struct work_struct *work) +{ + struct pgdat_entry *entry = container_of(work, struct pgdat_entry, work); + u64 cfp_timeout_ns = cfp_timeout_ms * NSEC_PER_MSEC; + struct pglist_data *pgdat = entry->pgdat; + unsigned long flags, order, t; + struct page *page; + struct zone *zone; + u64 start, now; + + start = sched_clock(); + + for_each_populated_zone_pgdat(pgdat, zone) { + spin_lock_irqsave(&zone->lock, flags); + for_each_migratetype_order(order, t) { + list_for_each_entry(page, &zone->free_area[order].free_list[t], lru) { + now = sched_clock(); + if (unlikely(now - start > cfp_timeout_ns)) { + spin_unlock_irqrestore(&zone->lock, flags); + goto out; + } + +#ifdef CONFIG_KMAP_LOCAL + int i; + + /* Clear highmem by clear_highpage() */ + for (i = 0; i < (1 << order); i++) + clear_highpage(page + i); +#else + memset(page_address(page), 0, (1 << order) * PAGE_SIZE); +#endif + touch_nmi_watchdog(); + atomic_add(1 << order, &clear_pages_num); + } + } + spin_unlock_irqrestore(&zone->lock, flags); + + cond_resched(); + } + +out: + kfree(entry); + + if (atomic_dec_and_test(&clear_freelist_workers)) + wake_up(&clear_freelist_wait); +} + +static void init_clear_freelist_work(struct pglist_data *pgdat) +{ + struct pgdat_entry *entry; + + entry = kzalloc(sizeof(struct pgdat_entry), GFP_KERNEL); + if (!entry) + return; + + entry->pgdat = pgdat; + INIT_WORK(&entry->work, clear_pgdat_freelist_pages); + queue_work_node(pgdat->node_id, system_unbound_wq, &entry->work); +} + +static void clear_freelist_pages(void) +{ + struct pglist_data *pgdat; + + mutex_lock(&clear_freelist_lock); + drain_all_pages(NULL); + + for_each_online_pgdat(pgdat) { + atomic_inc(&clear_freelist_workers); + init_clear_freelist_work(pgdat); + } + + wait_event(clear_freelist_wait, atomic_read(&clear_freelist_workers) == 0); + + pr_debug("Cleared pages %d\nFree pages %lu\n", atomic_read(&clear_pages_num), + global_zone_page_state(NR_FREE_PAGES)); + atomic_set(&clear_pages_num, 0); + + mutex_unlock(&clear_freelist_lock); +} + +static int sysctl_clear_freelist_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + int ret; + int val; + + table->data = &val; + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + + if (!ret && write) + clear_freelist_pages(); + + return ret; +} + +static struct ctl_table clear_freelist_table[] = { + { + .procname = "clear_freelist_pages", + .data = NULL, + .maxlen = sizeof(int), + .mode = 0200, + .proc_handler = &sysctl_clear_freelist_handler, + .extra1 = SYSCTL_ONE, + .extra2 = SYSCTL_ONE, + }, + { } +}; + +static bool clear_freelist_enabled; +static int __init setup_clear_freelist(char *str) +{ + clear_freelist_enabled = true; + return 1; +} +__setup("clear_freelist", setup_clear_freelist); + +static int __init clear_freelist_init(void) +{ + if (clear_freelist_enabled) + register_sysctl_init("vm", clear_freelist_table); + + return 0; +} +module_init(clear_freelist_init); +module_param(cfp_timeout_ms, ulong, 0644); -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/3] block: show info about opening a mounted device for write
by Li Lingfeng 29 Dec '23

29 Dec '23

Both writing a mounted device and writing part0 while mounting a partition will provide a prompt message. v1->v2: 1) Replace BLK_DEV_DUMPINFO with BLK_DEV_WRITE_MOUNTED_QUIET, which is logically opposite; 2) Make BLK_DEV_WRITE_MOUNTED_QUIET dependent on BLK_DEV_WRITE_MOUNTED, and decide whether to set bd_writers by BLK_DEV_WRITE_MOUNTED_QUIET; 3) Move bdev_dump_info() into bdev_may_open(); 4) Add the cmdline interface to control whether to show info; 5) Pass the state of "writes blocked" to part0 when mounting a partition. Li Lingfeng (3): block: Add config to show info about opening a mounted device for write block: detect confilt of write and mount between partitions and part0 block: show info of confilt of write and mount between partitions and part0 block/Kconfig | 9 +++++ block/bdev.c | 103 +++++++++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 107 insertions(+), 5 deletions(-) -- 2.31.1

2 4

[PATCH OLK-6.6 0/3] block mainline bugfix backport
by Li Nan 29 Dec '23

29 Dec '23

Li Nan (2): block: add check of 'minors' and 'first_minor' in device_add_disk() block: Set memalloc_noio to false on device_add_disk() error path Min Li (1): block: add check that partition length needs to be aligned with block size block/genhd.c | 5 ++++- block/ioctl.c | 11 +++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) -- 2.39.2

2 4

[PATCH OLK-6.6] mm/hugetlb: Introduce alloc_hugetlb_folio_size()
by Wang Wensheng 29 Dec '23

29 Dec '23

ascend inclusion category: Feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8SC4J --------------------------------------------- This could allocate hugepage from hpool of specific size. The driver would map those hugepage for some special processes via hugetlb_insert_hugepage_pte(). Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- include/linux/hugetlb.h | 14 ++++++++++++++ mm/hugetlb.c | 27 +++++++++++++++++++++++++++ 2 files changed, 41 insertions(+) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 57c2630cb80d..1883751673b8 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -302,6 +302,15 @@ static inline int hugetlb_insert_hugepage_pte_by_pa(struct mm_struct *mm, } #endif /* CONFIG_HUGETLB_INSERT_PAGE */ +#ifdef CONFIG_ASCEND_FEATURES +struct folio *alloc_hugetlb_folio_size(int nid, unsigned long size); +#else +static inline struct folio *alloc_hugetlb_folio_size(int nid, unsigned long size) +{ + return NULL; +} +#endif + #else /* !CONFIG_HUGETLB_PAGE */ static inline void hugetlb_dup_vma_private(struct vm_area_struct *vma) @@ -523,6 +532,11 @@ static inline int hugetlb_insert_hugepage_pte_by_pa(struct mm_struct *mm, return -EPERM; } +static inline struct folio *alloc_hugetlb_folio_size(int nid, unsigned long size) +{ + return NULL; +} + #endif /* !CONFIG_HUGETLB_PAGE */ /* * hugepages at page global directory. If arch support diff --git a/mm/hugetlb.c b/mm/hugetlb.c index adffb0ce1e6e..d996a63ebf50 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -7633,3 +7633,30 @@ int hugetlb_insert_hugepage_pte_by_pa(struct mm_struct *mm, unsigned long addr, } EXPORT_SYMBOL_GPL(hugetlb_insert_hugepage_pte_by_pa); #endif /* CONFIG_HUGETLB_INSERT_PAGE */ + +#ifdef CONFIG_ASCEND_FEATURES +struct folio *alloc_hugetlb_folio_size(int nid, unsigned long size) +{ + gfp_t gfp_mask; + struct hstate *h; + nodemask_t nodemask; + unsigned long flags; + struct folio *folio = NULL; + + nodes_clear(nodemask); + node_set(nid, nodemask); + + h = size_to_hstate(size); + if (!h) + return NULL; + + gfp_mask = htlb_alloc_mask(h); + spin_lock_irqsave(&hugetlb_lock, flags); + if (h->free_huge_pages - h->resv_huge_pages > 0) + folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask, nid, &nodemask); + spin_unlock_irqrestore(&hugetlb_lock, flags); + + return folio; +} +EXPORT_SYMBOL(alloc_hugetlb_folio_size); +#endif -- 2.17.1

2 1

[PATCH OLK-6.6 v2 0/4] Terrace Service Acceleration
by Zhengchao Shao 29 Dec '23

29 Dec '23

Terrace Service Acceleration. Liu Jian (1): bpf: Add new bpf helper to get SO_ORIGINAL_DST/REPLY_SRC Lu Wei (1): net: core: Add a GID field to struct sock. Wang Yufen (1): bpf, sockmap: Add sk_rmem_alloc check for sockmap Zhengchao Shao (1): bpf: Add bpf_get_sockops_uid_gid helper function include/net/netfilter/nf_conntrack.h | 6 +++ include/net/sock.h | 18 +++++++ include/uapi/linux/bpf.h | 2 + include/uapi/linux/netfilter_ipv4.h | 2 + net/Kconfig | 7 +++ net/core/filter.c | 64 +++++++++++++++++++++++++ net/core/skmsg.c | 10 +++- net/core/sock.c | 6 +++ net/ipv4/tcp_bpf.c | 10 ++++ net/netfilter/nf_conntrack_proto.c | 71 ++++++++++++++++++++++++++++ net/socket.c | 8 +++- 11 files changed, 201 insertions(+), 3 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] smb: client: fix potential OOB in smb2_dump_detail()
by ZhaoLong Wang 29 Dec '23

29 Dec '23

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc7 commit 567320c46a60a3c39b69aa1df802d753817a3f86 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8MXXY CVE: CVE-2023-6610 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Validate SMB message with ->check_message() before calling ->calc_smb_size(). This fixes CVE-2023-6610. Reported-by: j51569436(a)gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218219 Cc; stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Conflicts: fs/cifs/smb2ops.c fs/cifs/smb2misc.c --- fs/cifs/smb2misc.c | 30 +++++++++++++++--------------- fs/cifs/smb2ops.c | 6 ++++-- 2 files changed, 19 insertions(+), 17 deletions(-) diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index 5236636f71b5..94fb82077bdd 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -165,6 +165,21 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr) } mid = le64_to_cpu(shdr->MessageId); + if (check_smb2_hdr(shdr, mid)) + return 1; + + if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { + cifs_dbg(VFS, "Invalid structure size %u\n", + le16_to_cpu(shdr->StructureSize)); + return 1; + } + + command = le16_to_cpu(shdr->Command); + if (command >= NUMBER_OF_SMB2_COMMANDS) { + cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); + return 1; + } + if (len < pdu_size) { if ((len >= hdr_size) && (shdr->Status != 0)) { @@ -185,21 +200,6 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr) return 1; } - if (check_smb2_hdr(shdr, mid)) - return 1; - - if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { - cifs_dbg(VFS, "Illegal structure size %u\n", - le16_to_cpu(shdr->StructureSize)); - return 1; - } - - command = le16_to_cpu(shdr->Command); - if (command >= NUMBER_OF_SMB2_COMMANDS) { - cifs_dbg(VFS, "Illegal SMB2 command %d\n", command); - return 1; - } - if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) { if (command != SMB2_OPLOCK_BREAK_HE && (shdr->Status == 0 || pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2)) { diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 8aa3ab7bb802..4f6cc104fdb5 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -248,8 +248,10 @@ smb2_dump_detail(void *buf, struct TCP_Server_Info *server) cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, shdr->ProcessId); - cifs_dbg(VFS, "smb buf %p len %u\n", buf, - server->ops->calc_smb_size(buf, server)); + if (!server->ops->check_message(buf, server->total_read, server)) { + cifs_dbg(VFS, "smb buf %p len %u\n", buf, + server->ops->calc_smb_size(buf, server)); + } #endif } -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] smb: client: fix OOB in smbCalcSize()
by ZhaoLong Wang 29 Dec '23

29 Dec '23

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc7 commit b35858b3786ddbb56e1c35138ba25d6adf8d0bef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8MXXW CVE: CVE-2023-6606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Validate @smb->WordCount to avoid reading off the end of @smb and thus causing the following KASAN splat: BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs] Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328 CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __phys_addr+0x46/0x90 kasan_report+0xd8/0x110 ? smbCalcSize+0x32/0x40 [cifs] ? smbCalcSize+0x32/0x40 [cifs] kasan_check_range+0x105/0x1b0 smbCalcSize+0x32/0x40 [cifs] checkSMB+0x162/0x370 [cifs] ? __pfx_checkSMB+0x10/0x10 [cifs] cifs_handle_standard+0xbc/0x2f0 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 cifs_demultiplex_thread+0xed1/0x1360 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0x136/0x210 ? __pfx_lock_release+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? mark_held_locks+0x1a/0x90 ? lockdep_hardirqs_on_prepare+0x136/0x210 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __kthread_parkme+0xce/0xf0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x18d/0x1d0 ? kthread+0xdb/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> This fixes CVE-2023-6606. Reported-by: j51569436(a)gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218 Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Conflicts: fs/cifs/misc.c --- fs/cifs/misc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 0863997f78b5..a1563987de48 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -344,6 +344,10 @@ checkSMB(char *buf, unsigned int total_read, struct TCP_Server_Info *server) cifs_dbg(VFS, "Length less than smb header size\n"); } return -EIO; + } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { + cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", + __func__, smb->WordCount); + return -EIO; } /* otherwise, there is enough to get to the BCC */ -- 2.34.3

2 1

[PATCH OLK-6.6 v2 0/2] KABI reservation for IMA and crypto
by GUO Zihua 29 Dec '23

29 Dec '23

KABI reservation for IMA and crypto module. v2: Changed reservation ordering, and more reservation. GUO Zihua (2): crypto: kabi: KABI reservation for crypto ima: kabi: KABI reservation for IMA include/crypto/aead.h | 4 ++++ include/crypto/akcipher.h | 4 ++++ include/crypto/algapi.h | 4 ++++ include/crypto/cryptd.h | 2 ++ include/crypto/hash.h | 5 +++++ include/crypto/if_alg.h | 6 ++++++ include/crypto/public_key.h | 3 +++ include/crypto/rng.h | 3 +++ include/crypto/skcipher.h | 4 ++++ include/linux/crypto.h | 3 +++ include/linux/fs.h | 2 ++ include/linux/kernel_read_file.h | 3 +++ include/linux/kexec.h | 5 +++++ include/linux/user_namespace.h | 3 +++ 14 files changed, 51 insertions(+) -- 2.34.1

2 3

会议提醒//openEuler Kernel SIG双周例会
by liaotao (C) 29 Dec '23

29 Dec '23

2023-12-29 14:00 【openEuler Kernel SIG双周例会】会议内容：议题一：进展update（张伽琳 & 章昌仲）议题二：新增树莓派dev分包议题三：内核态vDPA支持热迁移特性回合SP1/SP2影响评审期待您的参加，欢迎您在以下地址【申报议题】：https://etherpad.openeuler.org/p/Kernel-meetings -----原始约会----- 发件人: openEuler conference <public(a)openeuler.org> 发送时间: 2023年12月27日 14:08 收件人: dev@openeuler.org,kernel-discuss@openeuler.org,kernel@openeuler.org 主题: openEuler Kernel SIG双周例会时间: 2023年12月29日星期五 14:00-15:45(UTC+08:00) 北京，重庆，香港特别行政区，乌鲁木齐。地点: 您好！ Kernel SIG 邀请您参加 2023-12-29 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/986451425 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference(auto recording) will be held at 2023-12-29 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/986451425. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10] net/rose: Fix Use-After-Free in rose_ioctl
by Lu Wei 29 Dec '23

29 Dec '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.7-rc6 commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8RXMW CVE: CVE-2023-51782 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Because rose_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with rose_accept(). A use-after-free for skb occurs with the following flow. ``` rose_ioctl() -> skb_peek() rose_accept() -> skb_dequeue() -> kfree_skb() ``` Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/rose/af_rose.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c index 86c93cf1744b..b3e7a92f1ec1 100644 --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -1307,9 +1307,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) case TIOCINQ: { struct sk_buff *skb; long amount = 0L; - /* These two are safe on a single CPU system as only user tasks fiddle here */ + + spin_lock_irq(&sk->sk_receive_queue.lock); if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) amount = skb->len; + spin_unlock_irq(&sk->sk_receive_queue.lock); return put_user(amount, (unsigned int __user *) argp); } -- 2.34.1

2 1