- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] net/sched: act_ct: fix wild memory access when clearing fragments
by Zhengchao Shao 07 Mar '24

07 Mar '24

From: Davide Caratti <dcaratti(a)redhat.com> mainline inclusion from mainline-v5.13-rc1 commit f77bd544a6bbe69aa50d9ed09f13494cf36ff806 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JMO CVE: CVE-2021-47014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS. Fixes: ae372cb1750f ("net/sched: act_ct: fix restore the qdisc_skb_cb after defrag") Fixes: 7baf2429a1a9 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support") Reported-by: Shuang Li <shuali(a)redhat.com> Signed-off-by: Davide Caratti <dcaratti(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_ct.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_ct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 2d41d866de3e..35668ce0b4a8 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -735,7 +735,8 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, #endif } - *qdisc_skb_cb(skb) = cb; + if (err != -EINPROGRESS) + *qdisc_skb_cb(skb) = cb; skb_clear_hash(skb); skb->ignore_df = 1; return err; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 07 Mar '24

07 Mar '24

From: tangyuchen <tangyuchen5(a)huawei.com> v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 +++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 174 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS V2 0/2] Fix CVE-2021-47047
by Guan Jing 07 Mar '24

07 Mar '24

fix CVE-2021-47047 Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS V1 0/2] fix dma_map_single fails
by Guan Jing 07 Mar '24

07 Mar '24

fix dma_map_single fails Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Fixed CVE-2021-47037
by Zheng Zengkai 07 Mar '24

07 Mar '24

Q6afe-clocks driver can get reprobed. For example if the APR services are restarted after the firmware crash. However currently Q6afe-clocks driver will oops because hw.init will get cleared during first _probe call. Rewrite the driver to fill the clock data at runtime rather than using big static array of clocks. This issue was identified as CVE-2021-47037. Backport patches from linux 5.13-rc1 to fix this CVE. Dmitry Baryshkov (1): ASoC: q6afe-clocks: fix reprobing of the driver Srinivas Kandagatla (1): ASoC: q6afe-clocks: fix warning on symbol scope sound/soc/qcom/qdsp6/q6afe-clocks.c | 209 ++++++++++++++-------------- sound/soc/qcom/qdsp6/q6afe.c | 2 +- sound/soc/qcom/qdsp6/q6afe.h | 2 +- 3 files changed, 108 insertions(+), 105 deletions(-) -- 2.20.1

2 3

[PATCH v2 OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS] ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
by Liu Jian 07 Mar '24

07 Mar '24

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v4.19.191 commit 25a87b1f566b5eb2af2857a928f0e2310d900976 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCD CVE: CVE-2021-46998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 643001b47adc844ae33510c4bb93c236667008a3 ] In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if some error happens, the skb will be freed by dev_kfree_skb(skb). But the freed skb is still used in skb_tx_timestamp(skb). My patch makes enic_queue_wq_skb() return error and goto spin_unlock() incase of error. The solution is provided by Govind. See https://lkml.org/lkml/2021/4/30/961. Fixes: fb7516d42478e ("enic: add sw timestamp support") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Acked-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/cisco/enic/enic_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c index 733d9172425b..f8e82bc55f0f 100644 --- a/drivers/net/ethernet/cisco/enic/enic_main.c +++ b/drivers/net/ethernet/cisco/enic/enic_main.c @@ -803,7 +803,7 @@ static inline int enic_queue_wq_skb_encap(struct enic *enic, struct vnic_wq *wq, return err; } -static inline void enic_queue_wq_skb(struct enic *enic, +static inline int enic_queue_wq_skb(struct enic *enic, struct vnic_wq *wq, struct sk_buff *skb) { unsigned int mss = skb_shinfo(skb)->gso_size; @@ -849,6 +849,7 @@ static inline void enic_queue_wq_skb(struct enic *enic, wq->to_use = buf->next; dev_kfree_skb(skb); } + return err; } /* netif_tx_lock held, process context with BHs disabled, or BH */ @@ -892,7 +893,8 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, return NETDEV_TX_BUSY; } - enic_queue_wq_skb(enic, wq, skb); + if (enic_queue_wq_skb(enic, wq, skb)) + goto error; if (vnic_wq_desc_avail(wq) < MAX_SKB_FRAGS + ENIC_DESC_MAX_SPLITS) netif_tx_stop_queue(txq); @@ -900,6 +902,7 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, if (!skb->xmit_more || netif_xmit_stopped(txq)) vnic_wq_doorbell(wq); +error: spin_unlock(&enic->wq_lock[txq_map]); return NETDEV_TX_OK; -- 2.34.1

2 1

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13