- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/2] Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK"
by Wang Yufen 18 Jan '24

18 Jan '24

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v4.19.296 commit 88f8a01c42535285bcf2666d1f7eb9ada0de88cc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8XA2F CVE: NA -------------------------------- This reverts commit 42c8406432e730cb7442d97ecfdbf47084a5af4d which is commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 upstream. It was improperly backported to 4.19.y, and applied to the wrong function, which obviously causes problems. A fixed version will be applied as a separate commit later. Reported-by: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> Link: https://lore.kernel.org/r/ZSQeA8fhUT++iZvz@ostr-mac Cc: Ido Schimmel <idosch(a)nvidia.com> Cc: Jiri Pirko <jiri(a)nvidia.com> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Paolo Abeni <pabeni(a)redhat.com> Cc: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- net/core/rtnetlink.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 794db63..79f6251 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -2702,10 +2702,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, ifm = nlmsg_data(nlh); if (ifm->ifi_index > 0) dev = __dev_get_by_index(net, ifm->ifi_index); - else if (ifm->ifi_index < 0) { - NL_SET_ERR_MSG(extack, "ifindex can't be negative"); - return -EINVAL; - } else if (tb[IFLA_IFNAME]) + else if (tb[IFLA_IFNAME]) dev = __dev_get_by_name(net, ifname); else goto errout; -- 1.8.3.1

2 3

[PATCH OLK-6.6 00/12] aarch64 KABI reserved for module
by Yuntao Liu 18 Jan '24

18 Jan '24

reserve space for arm64 related structures. Yuntao Liu (12): kabi: reserve space for struct drm_fb_helper.h:drm_fb_helper drm_fb_helper.h:drm_fb_helper_funcs kabi: reserve space for struct drm_file.h:drm_minor drm_file.h:drm_file kabi: reserve space for struct drm_fourcc.h:drm_format_info kabi: reserve space for struct drm_gem.h:vm_operations_struct drm_gem.h:drm_gem_object kabi: reserve space for struct efi.h:efi kabi: reserve space for struct extable.h:exception_table_entry kabi: reserve space for struct fb.h:fb_deferred_io fb.h:fb_info kabi: reserve space for struct irq_work.h:irq_work kabi: reserve space for struct irqdesc.h:irq_desc kabi: reserve space for enum irqdomain_defs.h:irq_domain_bus_token kabi: reserve space for struct irqdomain.h:irq_domain kabi: reserve space for struct processor.h:thread_struct arch/arm64/include/asm/extable.h | 2 ++ arch/arm64/include/asm/processor.h | 9 +++++++++ include/drm/drm_fb_helper.h | 7 +++++++ include/drm/drm_file.h | 7 +++++++ include/drm/drm_fourcc.h | 3 +++ include/drm/drm_gem.h | 13 +++++++++++++ include/linux/efi.h | 3 +++ include/linux/fb.h | 7 +++++++ include/linux/irq_work.h | 4 ++++ include/linux/irqdesc.h | 3 +++ include/linux/irqdomain.h | 9 +++++++++ include/linux/irqdomain_defs.h | 12 ++++++++++++ 12 files changed, 79 insertions(+) -- 2.34.1

2 13

[PATCH OLK-5.10 0/3] x86/quirks: Add parameter to clear MSIs early on
by Zheng Zengkai 18 Jan '24

18 Jan '24

A crash kernel boot failure issue is reported in openeuler 5.10 series kernel(in x86 virtual machine with Hi1822 virtual nic). Finally the issue was narrowed down to irq vector conflict. Backport following patchset from kernel maillist to fix this issue. https://lore.kernel.org/linux-pci/20181018183721.27467-3-gpiccoli@canonical… Guilherme G. Piccoli (3): x86/quirks: Scan all busses for early PCI quirks x86/PCI: Export find_cap() to be used in early PCI code x86/quirks: Add parameter to clear MSIs early on boot .../admin-guide/kernel-parameters.txt | 6 +++ arch/x86/include/asm/pci-direct.h | 2 + arch/x86/kernel/aperture_64.c | 30 +------------ arch/x86/kernel/early-quirks.c | 45 ++++++++++++++++--- arch/x86/pci/common.c | 4 ++ arch/x86/pci/early.c | 25 +++++++++++ 6 files changed, 77 insertions(+), 35 deletions(-) -- 2.20.1

2 4

[PATCH OLK-6.6 0/9] Backport etmem feature to OLK 6.6
by Yuchen Tang 18 Jan '24

18 Jan '24

v4 -> v5 - fix redundant kvm config check v3 -> v4 - backport only core etmem feature - modify kernel swap enabled toggle implementation v2 -> v3 - fix code style and commit messages v1 -> v2 - make independent patches to export symbols we need - make independent patches for etmem scan and swap config - fix indentation and code style problems Yuchen Tang (9): etmem: add ETMEM feature CONFIG to mm/Kconfig etmem: add ETMEM scan feature CONFIG to mm/Kconfig mm: Export symbol __pud_trans_huge_lock mm: Export symbol walk_page_range etmem: add etmem scan feature mm: Export symbol reclaim_pages etmem: add etmem swap feature etmem: add original kernel swap enabled options etmem: enable etmem configurations arch/arm64/configs/openeuler_defconfig | 3 + arch/x86/configs/openeuler_defconfig | 3 + fs/proc/Makefile | 3 + fs/proc/base.c | 8 + fs/proc/etmem_proc.c | 216 ++++ fs/proc/etmem_scan.c | 1383 ++++++++++++++++++++++++ fs/proc/etmem_scan.h | 149 +++ fs/proc/etmem_swap.c | 109 ++ fs/proc/internal.h | 4 + include/linux/etmem.h | 47 + include/linux/mm.h | 4 + include/linux/mm_types.h | 4 + include/linux/swap.h | 1 + include/uapi/asm-generic/mman-common.h | 4 + mm/Kconfig | 33 + mm/Makefile | 1 + mm/etmem.c | 95 ++ mm/huge_memory.c | 1 + mm/internal.h | 1 - mm/madvise.c | 16 + mm/pagewalk.c | 1 + mm/swap_state.c | 4 + mm/vmscan.c | 8 + virt/kvm/kvm_main.c | 8 + 24 files changed, 2105 insertions(+), 1 deletion(-) create mode 100644 fs/proc/etmem_proc.c create mode 100644 fs/proc/etmem_scan.c create mode 100644 fs/proc/etmem_scan.h create mode 100644 fs/proc/etmem_swap.c create mode 100644 include/linux/etmem.h create mode 100644 mm/etmem.c -- 2.33.0

2 10

[PATCH OLK-5.10] tipc: fix a potential deadlock on &tx->lock
by Zhengchao Shao 18 Jan '24

18 Jan '24

From: Chengfeng Ye <dg573847474(a)gmail.com> stable inclusion from stable-v5.10.198 commit 6a24d0661fa389c241d935da38e0f6a5ee8eb1ae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WZL1 CVE: CVE-2024-0641 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 08e50cf071847323414df0835109b6f3560d44f5 ] It seems that tipc_crypto_key_revoke() could be be invoked by wokequeue tipc_crypto_work_rx() under process context and timer/rx callback under softirq context, thus the lock acquisition on &tx->lock seems better use spin_lock_bh() to prevent possible deadlock. This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock. tipc_crypto_work_rx() <workqueue> --> tipc_crypto_key_distr() --> tipc_bcast_xmit() --> tipc_bcbase_xmit() --> tipc_bearer_bc_xmit() --> tipc_crypto_xmit() --> tipc_ehdr_build() --> tipc_crypto_key_revoke() --> spin_lock(&tx->lock) <timer interrupt> --> tipc_disc_timeout() --> tipc_bearer_xmit_skb() --> tipc_crypto_xmit() --> tipc_ehdr_build() --> tipc_crypto_key_revoke() --> spin_lock(&tx->lock) <deadlock here> Signed-off-by: Chengfeng Ye <dg573847474(a)gmail.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Acked-by: Jon Maloy <jmaloy(a)redhat.com> Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Link: https://lore.kernel.org/r/20230927181414.59928-1-dg573847474@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/tipc/crypto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index de63d6d41645..7d26d0cb207a 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -1445,14 +1445,14 @@ static int tipc_crypto_key_revoke(struct net *net, u8 tx_key) struct tipc_crypto *tx = tipc_net(net)->crypto_tx; struct tipc_key key; - spin_lock(&tx->lock); + spin_lock_bh(&tx->lock); key = tx->key; WARN_ON(!key.active || tx_key != key.active); /* Free the active key */ tipc_crypto_key_set_state(tx, key.passive, 0, key.pending); tipc_crypto_key_detach(tx->aead[key.active], &tx->lock); - spin_unlock(&tx->lock); + spin_unlock_bh(&tx->lock); pr_warn("%s: key is revoked\n", tx->name); return -EKEYREVOKED; -- 2.34.1

2 1

[PATCH OLK-6.6 v2] mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task()
by Jinjiang Tu 18 Jan '24

18 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8WVL2 CVE: NA -------------------------------- When memcg oom occurs, commit be8d95530886 ("memcg: support priority for oom") calls memcg_print_bad_task() to print oc->chosen when the chosen task comes from low-priority memcg. oc->chosen may be assigned with -1 in oom_evaluate_task(). Howerver, memcg_print_bad_task() does't check if oc->chosen is -1 and leads to NULL pointer dereference. To fix it, check if oc->chosen is -1 in memcg_print_bad_task(). Fixes: be8d95530886 ("memcg: support priority for oom") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7ab0eec942ba..8327cef9d53a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4219,7 +4219,7 @@ void memcg_print_bad_task(struct oom_control *oc) if (memcg_oom_prio_disabled()) return; - if (oc->chosen) { + if (oc->chosen && oc->chosen != (void *)-1UL) { struct mem_cgroup *memcg; rcu_read_lock(); -- 2.25.1

2 1

[OLK-5.10 0/3] x86/quirks: Add parameter to clear MSIs early on boot
by Zheng Zengkai 18 Jan '24

18 Jan '24

A crash kernel boot failure issue is reported in openeuler 5.10 series kernel(in x86 virtual machine with Hi1822 virtual nic). Finally the issue was narrowed down to irq vector conflict. Backport following patchset from kernel maillist to fix this issue. https://lore.kernel.org/linux-pci/20181018183721.27467-3-gpiccoli@canonical… Guilherme G. Piccoli (3): x86/quirks: Scan all busses for early PCI quirks x86/PCI: Export find_cap() to be used in early PCI code x86/quirks: Add parameter to clear MSIs early on boot .../admin-guide/kernel-parameters.txt | 6 +++ arch/x86/include/asm/pci-direct.h | 2 + arch/x86/kernel/aperture_64.c | 30 +------------ arch/x86/kernel/early-quirks.c | 45 ++++++++++++++++--- arch/x86/pci/common.c | 4 ++ arch/x86/pci/early.c | 25 +++++++++++ 6 files changed, 77 insertions(+), 35 deletions(-) -- 2.20.1

1 3

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2022-48619
by Liao Chen 18 Jan '24

18 Jan '24

fix CVE-2022-48619 Jeff LaBundy (1): Input: add bounds checking to input_set_capability() drivers/input/input.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.8 commit 534733397da26de0303057ce0b93a22bda150365 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 upstream. Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/smb/client/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 386b62d5c133..ea7ccaea711a 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4937,6 +4937,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -4965,14 +4966,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -4996,8 +4998,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc6 commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/smb2ops.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 4f6cc104fdb5..eba4bdfff08a 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -3185,6 +3185,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_sync_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -3213,14 +3214,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_sync_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -3244,8 +3246,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1