- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] fix CVE-2023-6817 and CVE-2023-4244
by Dong Chenchen 20 Dec '23

20 Dec '23

fix CVE-2023-6817 and CVE-2023-4244 Florian Westphal (2): netfilter: nf_tables: don't skip expired elements during walk netfilter: nft_set_pipapo: skip inactive elements during set walk net/netfilter/nf_tables_api.c | 4 ++++ net/netfilter/nft_set_hash.c | 2 -- net/netfilter/nft_set_pipapo.c | 19 ++++++++++++++----- net/netfilter/nft_set_rbtree.c | 2 -- 4 files changed, 18 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/8] adapt kabi reserve patch to OLK6.6
by Lin Yujun 20 Dec '23

20 Dec '23

*** BLURB HERE *** Chen Jiahao (2): KABI: reserve space for several i2c structures KABI: reserve space for struct input_dev Lin Ruizhe (6): bootparam: Add kabi_reserve in bootparam interrupt: Add kabi_reserve in interrupt.h irq: Add kabi_reserve in irq irq_desc: Add kabi_reserve in irq_desc irqdomain: Add kabi_reserve in irqdomain msi: Add kabi_reserve in msi.h arch/x86/include/uapi/asm/bootparam.h | 2 ++ include/linux/i2c.h | 11 +++++++++++ include/linux/input.h | 4 ++++ include/linux/interrupt.h | 4 ++++ include/linux/irq.h | 6 ++++++ include/linux/irqdesc.h | 3 ++- include/linux/irqdomain.h | 2 ++ include/linux/msi.h | 3 +++ 8 files changed, 34 insertions(+), 1 deletion(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/5] ubi: Enhanced fault injection capability for the UBI driver
by ZhaoLong Wang 20 Dec '23

20 Dec '23

CONFIG Dependency CONFIG_MTD=y CONFIG_MTD_NAND_NANDSIM=m CONFIG_MTD_UBI=m CONFIG_FAULT_INJECTION_DEBUG_FS=y CONFIG_MTD_PARTITIONED_MASTER The existing fault injection capability of UBI is too simple. It uses hard-coded fault probability values and lacks other configurable options. As a result, these interfaces are difficult to use when digging defects in the abnormal path of code and reproducing some problems. The kernel provides a powerful fault injection framework, which provides rich configurable fault injection attributes during runtime. So it can be used to improve the fault injection capability of the UBI driver. This series of patches refactor the existing fault injection interface and add some fault injection types to help testers and developers find potential problems in the code. This series of patches enhance the existing fault injection interface and retain the old debugfs interface, and add some fault injection types to help testers and developers Look for potential problems in the code. ZhaoLong Wang (5): ubi: Use the fault injection framework to enhance the fault injection capability ubi: Split io_failures into write_failure and erase_failure ubi: Add six fault injection type for testing ubi: Reserve sufficient buffer length for the input mask mtd: Add several functions to the fail_function list drivers/mtd/mtdcore.c | 5 + drivers/mtd/ubi/Kconfig | 9 ++ drivers/mtd/ubi/debug.c | 107 ++++++++++++-- drivers/mtd/ubi/debug.h | 304 +++++++++++++++++++++++++++++++++++++--- drivers/mtd/ubi/io.c | 86 +++++++++++- drivers/mtd/ubi/ubi.h | 45 +++--- 6 files changed, 497 insertions(+), 59 deletions(-) -- 2.39.2

2 6

[PATCH OLK-6.6 v5] ascend: export interfaces required by ascend drivers
by Yuan Can 20 Dec '23

20 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8OX3Q CVE: NA -------------------------------- Export oom_type_notifier_call and __get_vm_area_caller. Export pm_autosleep_set_state and __vmalloc_node_range. Export alloc_workqueue_attrs, free_workqueue_attrs and apply_workqueue_attrs. Export find_get_task_by_vpid. Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- kernel/pid.c | 1 + kernel/power/autosleep.c | 1 + kernel/workqueue.c | 3 +++ mm/oom_kill.c | 1 + mm/vmalloc.c | 2 ++ 5 files changed, 8 insertions(+) diff --git a/kernel/pid.c b/kernel/pid.c index 6500ef956f2f..383abde0c208 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -437,6 +437,7 @@ struct task_struct *find_get_task_by_vpid(pid_t nr) return task; } +EXPORT_SYMBOL_GPL(find_get_task_by_vpid); struct pid *get_task_pid(struct task_struct *task, enum pid_type type) { diff --git a/kernel/power/autosleep.c b/kernel/power/autosleep.c index b29c8aca7486..80ba474daa40 100644 --- a/kernel/power/autosleep.c +++ b/kernel/power/autosleep.c @@ -113,6 +113,7 @@ int pm_autosleep_set_state(suspend_state_t state) mutex_unlock(&autosleep_lock); return 0; } +EXPORT_SYMBOL_GPL(pm_autosleep_set_state); int __init pm_autosleep_init(void) { diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 0f682da96e1c..3eabf97c4e9a 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -3713,6 +3713,7 @@ void free_workqueue_attrs(struct workqueue_attrs *attrs) kfree(attrs); } } +EXPORT_SYMBOL_GPL(free_workqueue_attrs); /** * alloc_workqueue_attrs - allocate a workqueue_attrs @@ -3741,6 +3742,7 @@ struct workqueue_attrs *alloc_workqueue_attrs(void) free_workqueue_attrs(attrs); return NULL; } +EXPORT_SYMBOL_GPL(alloc_workqueue_attrs); static void copy_workqueue_attrs(struct workqueue_attrs *to, const struct workqueue_attrs *from) @@ -4482,6 +4484,7 @@ int apply_workqueue_attrs(struct workqueue_struct *wq, return ret; } +EXPORT_SYMBOL_GPL(apply_workqueue_attrs); /** * wq_update_pod - update pod affinity of a wq for CPU hot[un]plug diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 601ee56cc7d7..81b79f82f601 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -1141,6 +1141,7 @@ int oom_type_notifier_call(unsigned int type, struct oom_control *oc) return blocking_notifier_call_chain(&oom_type_notify_list, type, NULL); } +EXPORT_SYMBOL_GPL(oom_type_notifier_call); #endif /** diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 30665fb33589..31761425d7a8 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2622,6 +2622,7 @@ struct vm_struct *__get_vm_area_caller(unsigned long size, unsigned long flags, return __get_vm_area_node(size, 1, PAGE_SHIFT, flags, start, end, NUMA_NO_NODE, GFP_KERNEL, caller); } +EXPORT_SYMBOL(__get_vm_area_caller); /** * get_vm_area - reserve a contiguous kernel virtual area @@ -3362,6 +3363,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, return NULL; } +EXPORT_SYMBOL(__vmalloc_node_range); /** * __vmalloc_node - allocate virtually contiguous memory -- 2.17.1

2 1

[PATCH OLK-6.6 v4] ascend: export interfaces required by ascend drivers
by Yuan Can 20 Dec '23

20 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8OX3Q CVE: NA -------------------------------- Export oom_type_notifier_call and __get_vm_area_caller. Export pm_autosleep_set_state and __vmalloc_node_range. Export alloc_workqueue_attrs, free_workqueue_attrs and apply_workqueue_attrs. Export find_get_task_by_vpid. Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- kernel/pid.c | 1 + kernel/power/autosleep.c | 1 + kernel/workqueue.c | 3 +++ mm/oom_kill.c | 1 + mm/vmalloc.c | 2 ++ 5 files changed, 8 insertions(+) diff --git a/kernel/pid.c b/kernel/pid.c index 6500ef956f2f..383abde0c208 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -437,6 +437,7 @@ struct task_struct *find_get_task_by_vpid(pid_t nr) return task; } +EXPORT_SYMBOL_GPL(find_get_task_by_vpid); struct pid *get_task_pid(struct task_struct *task, enum pid_type type) { diff --git a/kernel/power/autosleep.c b/kernel/power/autosleep.c index b29c8aca7486..80ba474daa40 100644 --- a/kernel/power/autosleep.c +++ b/kernel/power/autosleep.c @@ -113,6 +113,7 @@ int pm_autosleep_set_state(suspend_state_t state) mutex_unlock(&autosleep_lock); return 0; } +EXPORT_SYMBOL_GPL(pm_autosleep_set_state); int __init pm_autosleep_init(void) { diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 0f682da96e1c..3eabf97c4e9a 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -3713,6 +3713,7 @@ void free_workqueue_attrs(struct workqueue_attrs *attrs) kfree(attrs); } } +EXPORT_SYMBOL_GPL(free_workqueue_attrs); /** * alloc_workqueue_attrs - allocate a workqueue_attrs @@ -3741,6 +3742,7 @@ struct workqueue_attrs *alloc_workqueue_attrs(void) free_workqueue_attrs(attrs); return NULL; } +EXPORT_SYMBOL_GPL(alloc_workqueue_attrs); static void copy_workqueue_attrs(struct workqueue_attrs *to, const struct workqueue_attrs *from) @@ -4482,6 +4484,7 @@ int apply_workqueue_attrs(struct workqueue_struct *wq, return ret; } +EXPORT_SYMBOL_GPL(apply_workqueue_attrs); /** * wq_update_pod - update pod affinity of a wq for CPU hot[un]plug diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 601ee56cc7d7..81b79f82f601 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -1141,6 +1141,7 @@ int oom_type_notifier_call(unsigned int type, struct oom_control *oc) return blocking_notifier_call_chain(&oom_type_notify_list, type, NULL); } +EXPORT_SYMBOL_GPL(oom_type_notifier_call); #endif /** diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 30665fb33589..719539b32488 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2622,6 +2622,7 @@ struct vm_struct *__get_vm_area_caller(unsigned long size, unsigned long flags, return __get_vm_area_node(size, 1, PAGE_SHIFT, flags, start, end, NUMA_NO_NODE, GFP_KERNEL, caller); } +EXPORT_SYMBOL(__get_vm_area_caller); /** * get_vm_area - reserve a contiguous kernel virtual area @@ -3362,6 +3363,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, return NULL; } +EXPORT_SYMBOL_GPL(__vmalloc_node_range); /** * __vmalloc_node - allocate virtually contiguous memory -- 2.17.1

2 1

[PATCH OLK-6.6 0/1] Support priority load balance for qos scheduler
by Song Zhang 20 Dec '23

20 Dec '23

Song Zhang (1): sched: Introduce priority load balance for qos scheduler arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + init/Kconfig | 9 +++ kernel/sched/core.c | 3 + kernel/sched/fair.c | 90 +++++++++++++++++++++++++- kernel/sched/sched.h | 3 + 6 files changed, 106 insertions(+), 1 deletion(-) -- 2.33.0

2 2

[PATCH V3 OLK-6.6 0/3] sync smmu patches for olk-6.6
by Zhang Zekun 19 Dec '23

19 Dec '23

Make the rache depot scale better. The origin depot size is fixed, may cause problem in some condition. Add another patch to fix smmu problem. v2->v3: - Add a smmu bugfix patch v1->v2: - Change the commit messge Robin Murphy (2): iommu/iova: Make the rcache depot scale better iommu/iova: Manage the depot list size Wenkai Lin (1): iommu/arm-smmu-v3: disable stall for quiet_cd drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 3 + drivers/iommu/iova.c | 95 ++++++++++++++------- 2 files changed, 68 insertions(+), 30 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6 0/8] adapt kabi reserve patch to OLK6.6
by Lin Yujun 19 Dec '23

19 Dec '23

*** BLURB HERE *** Chen Jiahao (2): KABI: reserve space for several i2c structures KABI: reserve space for struct input_dev Lin Ruizhe (6): bootparam: Add kabi_reserve in bootparam interrupt: Add kabi_reserve in interrupt.h irq: Add kabi_reserve in irq irq_desc: Add kabi_reserve in irq_desc irqdomain: Add kabi_reserve in irqdomain msi: Add kabi_reserve in msi.h arch/x86/include/uapi/asm/bootparam.h | 2 ++ include/linux/i2c.h | 11 +++++++++++ include/linux/input.h | 4 ++++ include/linux/interrupt.h | 4 ++++ include/linux/irq.h | 6 ++++++ include/linux/irqdesc.h | 3 ++- include/linux/irqdomain.h | 2 ++ include/linux/msi.h | 3 +++ 8 files changed, 34 insertions(+), 1 deletion(-) -- 2.34.1

2 9

[PATCH OLK-6.6 v2 0/5] Terrace Service Acceleration
by Zhengchao Shao 19 Dec '23

19 Dec '23

Terrace Service Acceleration. Liu Jian (3): bpf: Add bpf_get_sockops_uid_gid helper function bpf: Add new bpf helper to get SO_ORIGINAL_DST/REPLY_SRC bpf: Access bpf_sock's src_ip4 and sorc_port in BPF_CGROUP_INET_SOCK_RELEASE hook Lu Wei (1): net: core: Add a GID field to struct sock. Wang Yufen (1): bpf, sockmap: Add sk_rmem_alloc check for sockmap include/net/netfilter/nf_conntrack.h | 6 ++ include/net/sock.h | 18 ++++++ include/uapi/linux/bpf.h | 13 +++++ include/uapi/linux/netfilter_ipv4.h | 2 + net/Kconfig | 7 +++ net/core/filter.c | 84 ++++++++++++++++++++++++++++ net/core/skmsg.c | 10 +++- net/core/sock.c | 6 ++ net/ipv4/tcp_bpf.c | 10 ++++ net/netfilter/nf_conntrack_proto.c | 71 +++++++++++++++++++++++ net/socket.c | 8 ++- tools/include/uapi/linux/bpf.h | 13 +++++ 12 files changed, 245 insertions(+), 3 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0-LTS v2] net: Remove acked SYN flag from packet in the transmit queue correctly
by Dong Chenchen 19 Dec '23

19 Dec '23

mainline inclusion from mainline-v6.7-rc4 commit f99cd56230f56c8b6b33713c5be4da5d6766be1f category: bugfix bugzilla: 187254, https://gitee.com/openeuler/kernel/issues/I8PRTS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- syzkaller report: kernel BUG at net/core/skbuff.c:3452! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc4-00009-gbee0e7762ad2-dirty #135 RIP: 0010:skb_copy_and_csum_bits (net/core/skbuff.c:3452) Call Trace: icmp_glue_bits (net/ipv4/icmp.c:357) __ip_append_data.isra.0 (net/ipv4/ip_output.c:1165) ip_append_data (net/ipv4/ip_output.c:1362 net/ipv4/ip_output.c:1341) icmp_push_reply (net/ipv4/icmp.c:370) __icmp_send (./include/net/route.h:252 net/ipv4/icmp.c:772) ip_fragment.constprop.0 (./include/linux/skbuff.h:1234 net/ipv4/ip_output.c:592 net/ipv4/ip_output.c:577) __ip_finish_output (net/ipv4/ip_output.c:311 net/ipv4/ip_output.c:295) ip_output (net/ipv4/ip_output.c:427) __ip_queue_xmit (net/ipv4/ip_output.c:535) __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) __tcp_retransmit_skb (net/ipv4/tcp_output.c:3387) tcp_retransmit_skb (net/ipv4/tcp_output.c:3404) tcp_retransmit_timer (net/ipv4/tcp_timer.c:604) tcp_write_timer (./include/linux/spinlock.h:391 net/ipv4/tcp_timer.c:716) The panic issue was trigered by tcp simultaneous initiation. The initiation process is as follows: TCP A TCP B 1. CLOSED CLOSED 2. SYN-SENT --> <SEQ=100><CTL=SYN> ... 3. SYN-RECEIVED <-- <SEQ=300><CTL=SYN> <-- SYN-SENT 4. ... <SEQ=100><CTL=SYN> --> SYN-RECEIVED 5. SYN-RECEIVED --> <SEQ=100><ACK=301><CTL=SYN,ACK> ... // TCP B: not send challenge ack for ack limit or packet loss // TCP A: close tcp_close tcp_send_fin if (!tskb && tcp_under_memory_pressure(sk)) tskb = skb_rb_last(&sk->tcp_rtx_queue); //pick SYN_ACK packet TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN; // set FIN flag 6. FIN_WAIT_1 --> <SEQ=100><ACK=301><END_SEQ=102><CTL=SYN,FIN,ACK> ... // TCP B: send challenge ack to SYN_FIN_ACK 7. ... <SEQ=301><ACK=101><CTL=ACK> <-- SYN-RECEIVED //challenge ack // TCP A: <SND.UNA=101> 8. FIN_WAIT_1 --> <SEQ=101><ACK=301><END_SEQ=102><CTL=SYN,FIN,ACK> ... // retransmit panic __tcp_retransmit_skb //skb->len=0 tcp_trim_head len = tp->snd_una - TCP_SKB_CB(skb)->seq // len=101-100 __pskb_trim_head skb->data_len -= len // skb->len=-1, wrap around ... ... ip_fragment icmp_glue_bits //BUG_ON If we use tcp_trim_head() to remove acked SYN from packet that contains data or other flags, skb->len will be incorrectly decremented. We can remove SYN flag that has been acked from rtx_queue earlier than tcp_trim_head(), which can fix the problem mentioned above. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Link: https://lore.kernel.org/r/20231210020200.1539875-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/tcp_output.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 8cd673d75f68..90e0041ae9f7 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2930,7 +2930,13 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) if (skb_still_in_host_queue(sk, skb)) return -EBUSY; +start: if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) { + if (unlikely(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) { + TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN; + TCP_SKB_CB(skb)->seq++; + goto start; + } if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) { WARN_ON_ONCE(1); return -EINVAL; -- 2.25.1

2 1