- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19 1/2] kexec: Add quick kexec support for kernel
by Sang Yan 13 Aug '20

13 Aug '20

euleros inclusion category: feature bugzilla: NA issues: #I1RC8Z CVE: NA In normal kexec, relocating kernel may cost 5 ~ 10 seconds, to copy all segments from vmalloced memory to kernel boot memory, because of disabled mmu. We introduce quick kexec to save time of copying memory as above, just like kdump(kexec on crash), by using reserved memory "Quick Kexec". Constructing quick kimage as the same as crash kernel, then simply copy all segments of kimage to reserved memroy. We also add this support in syscall kexec_load using flags of KEXEC_QUICK. Signed-off-by: Sang Yan <sangyan(a)huawei.com> --- arch/Kconfig | 7 +++++++ include/linux/ioport.h | 3 +++ include/linux/kexec.h | 13 +++++++++++- include/uapi/linux/kexec.h | 3 +++ kernel/kexec.c | 10 ++++++++++ kernel/kexec_core.c | 41 +++++++++++++++++++++++++++++--------- 6 files changed, 67 insertions(+), 10 deletions(-) diff --git a/arch/Kconfig b/arch/Kconfig index b54e485e47ae..1a9d00a6e122 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -18,6 +18,13 @@ config KEXEC_CORE select CRASH_CORE bool +config QUICK_KEXEC + bool "Support for quick kexec" + depends on KEXEC_CORE + help + Say y here to enable this feature. + It use reserved memory to accelerate kexec. + config HAVE_IMA_KEXEC bool diff --git a/include/linux/ioport.h b/include/linux/ioport.h index 5330288da8db..a42a1800c133 100644 --- a/include/linux/ioport.h +++ b/include/linux/ioport.h @@ -139,6 +139,9 @@ enum { IORES_DESC_PERSISTENT_MEMORY_LEGACY = 5, IORES_DESC_DEVICE_PRIVATE_MEMORY = 6, IORES_DESC_DEVICE_PUBLIC_MEMORY = 7, +#ifdef CONFIG_QUICK_KEXEC + IORES_DESC_QUICK_KEXEC = 8, +#endif }; /* helpers to define resources */ diff --git a/include/linux/kexec.h b/include/linux/kexec.h index d6b8d0a69720..d5e42a44f2ca 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -233,9 +233,12 @@ struct kimage { unsigned long control_page; /* Flags to indicate special processing */ - unsigned int type : 1; + unsigned int type : 2; #define KEXEC_TYPE_DEFAULT 0 #define KEXEC_TYPE_CRASH 1 +#ifdef CONFIG_QUICK_KEXEC +#define KEXEC_TYPE_QUICK 2 +#endif unsigned int preserve_context : 1; /* If set, we are using file mode kexec syscall */ unsigned int file_mode:1; @@ -296,6 +299,11 @@ extern int kexec_load_disabled; #define KEXEC_FLAGS (KEXEC_ON_CRASH | KEXEC_PRESERVE_CONTEXT) #endif +#ifdef CONFIG_QUICK_KEXEC +#undef KEXEC_FLAGS +#define KEXEC_FLAGS (KEXEC_ON_CRASH | KEXEC_QUICK) +#endif + /* List of defined/legal kexec file flags */ #define KEXEC_FILE_FLAGS (KEXEC_FILE_UNLOAD | KEXEC_FILE_ON_CRASH | \ KEXEC_FILE_NO_INITRAMFS) @@ -305,6 +313,9 @@ extern int kexec_load_disabled; extern struct resource crashk_res; extern struct resource crashk_low_res; extern note_buf_t __percpu *crash_notes; +#ifdef CONFIG_QUICK_KEXEC +extern struct resource quick_kexec_res; +#endif /* flag to track if kexec reboot is in progress */ extern bool kexec_in_progress; diff --git a/include/uapi/linux/kexec.h b/include/uapi/linux/kexec.h index 6d112868272d..dcf9857452da 100644 --- a/include/uapi/linux/kexec.h +++ b/include/uapi/linux/kexec.h @@ -12,6 +12,9 @@ /* kexec flags for different usage scenarios */ #define KEXEC_ON_CRASH 0x00000001 #define KEXEC_PRESERVE_CONTEXT 0x00000002 +#ifdef CONFIG_QUICK_KEXEC +#define KEXEC_QUICK 0x00000004 +#endif #define KEXEC_ARCH_MASK 0xffff0000 /* diff --git a/kernel/kexec.c b/kernel/kexec.c index 68559808fdfa..47dfad722b7c 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -46,6 +46,9 @@ static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, int ret; struct kimage *image; bool kexec_on_panic = flags & KEXEC_ON_CRASH; +#ifdef CONFIG_QUICK_KEXEC + bool kexec_on_quick = flags & KEXEC_QUICK; +#endif if (kexec_on_panic) { /* Verify we have a valid entry point */ @@ -71,6 +74,13 @@ static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, image->type = KEXEC_TYPE_CRASH; } +#ifdef CONFIG_QUICK_KEXEC + if (kexec_on_quick) { + image->control_page = quick_kexec_res.start; + image->type = KEXEC_TYPE_QUICK; + } +#endif + ret = sanity_check_segment_list(image); if (ret) goto out_free_image; diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index b36c9c46cd2c..595a757af656 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -74,6 +74,16 @@ struct resource crashk_low_res = { .desc = IORES_DESC_CRASH_KERNEL }; +#ifdef CONFIG_QUICK_KEXEC +struct resource quick_kexec_res = { + .name = "Quick kexec", + .start = 0, + .end = 0, + .flags = IORESOURCE_BUSY | IORESOURCE_SYSTEM_RAM, + .desc = IORES_DESC_QUICK_KEXEC +}; +#endif + int kexec_should_crash(struct task_struct *p) { /* @@ -470,8 +480,10 @@ static struct page *kimage_alloc_normal_control_pages(struct kimage *image, return pages; } -static struct page *kimage_alloc_crash_control_pages(struct kimage *image, - unsigned int order) + +static struct page *kimage_alloc_special_control_pages(struct kimage *image, + unsigned int order, + unsigned long end) { /* Control pages are special, they are the intermediaries * that are needed while we copy the rest of the pages @@ -501,7 +513,7 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image, size = (1 << order) << PAGE_SHIFT; hole_start = (image->control_page + (size - 1)) & ~(size - 1); hole_end = hole_start + size - 1; - while (hole_end <= crashk_res.end) { + while (hole_end <= end) { unsigned long i; cond_resched(); @@ -536,7 +548,6 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image, return pages; } - struct page *kimage_alloc_control_pages(struct kimage *image, unsigned int order) { @@ -547,8 +558,15 @@ struct page *kimage_alloc_control_pages(struct kimage *image, pages = kimage_alloc_normal_control_pages(image, order); break; case KEXEC_TYPE_CRASH: - pages = kimage_alloc_crash_control_pages(image, order); + pages = kimage_alloc_special_control_pages(image, order, + crashk_res.end); + break; +#ifdef CONFIG_QUICK_KEXEC + case KEXEC_TYPE_QUICK: + pages = kimage_alloc_special_control_pages(image, order, + quick_kexec_res.end); break; +#endif } return pages; @@ -898,11 +916,11 @@ static int kimage_load_normal_segment(struct kimage *image, return result; } -static int kimage_load_crash_segment(struct kimage *image, +static int kimage_load_special_segment(struct kimage *image, struct kexec_segment *segment) { - /* For crash dumps kernels we simply copy the data from - * user space to it's destination. + /* For crash dumps kernels and quick kexec kernels + * we simply copy the data from user space to it's destination. * We do things a page at a time for the sake of kmap. */ unsigned long maddr; @@ -976,8 +994,13 @@ int kimage_load_segment(struct kimage *image, result = kimage_load_normal_segment(image, segment); break; case KEXEC_TYPE_CRASH: - result = kimage_load_crash_segment(image, segment); + result = kimage_load_special_segment(image, segment); + break; +#ifdef CONFIG_QUICK_KEXEC + case KEXEC_TYPE_QUICK: + result = kimage_load_special_segment(image, segment); break; +#endif } return result; -- 2.19.1

1 1

[PATCH kernel-4.19 1/2] kexec: Add quick kexec support for kernel
by Sang Yan 13 Aug '20

13 Aug '20

euleros inclusion category: feature bugzilla: NA issues: #I1RC8Z CVE: NA In normal kexec, relocating kernel may cost 5 ~ 10 seconds, to copy all segments from vmalloced memory to kernel boot memory, because of disabled mmu. We introduce quick kexec to save time of copying memory as above, just like kdump(kexec on crash), by using reserved memory "Quick Kexec". Constructing quick kimage as the same as crash kernel, then simply copy all segments of kimage to reserved memroy. We also add this support in syscall kexec_load using flags of KEXEC_QUICK. Signed-off-by: Sang Yan <sangyan(a)huawei.com> --- arch/Kconfig | 7 +++++++ include/linux/ioport.h | 3 +++ include/linux/kexec.h | 13 +++++++++++- include/uapi/linux/kexec.h | 3 +++ kernel/kexec.c | 10 ++++++++++ kernel/kexec_core.c | 41 +++++++++++++++++++++++++++++--------- 6 files changed, 67 insertions(+), 10 deletions(-) diff --git a/arch/Kconfig b/arch/Kconfig index b54e485e47ae..1a9d00a6e122 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -18,6 +18,13 @@ config KEXEC_CORE select CRASH_CORE bool +config QUICK_KEXEC + bool "Support for quick kexec" + depends on KEXEC_CORE + help + Say y here to enable this feature. + It use reserved memory to accelerate kexec. + config HAVE_IMA_KEXEC bool diff --git a/include/linux/ioport.h b/include/linux/ioport.h index 5330288da8db..a42a1800c133 100644 --- a/include/linux/ioport.h +++ b/include/linux/ioport.h @@ -139,6 +139,9 @@ enum { IORES_DESC_PERSISTENT_MEMORY_LEGACY = 5, IORES_DESC_DEVICE_PRIVATE_MEMORY = 6, IORES_DESC_DEVICE_PUBLIC_MEMORY = 7, +#ifdef CONFIG_QUICK_KEXEC + IORES_DESC_QUICK_KEXEC = 8, +#endif }; /* helpers to define resources */ diff --git a/include/linux/kexec.h b/include/linux/kexec.h index d6b8d0a69720..d5e42a44f2ca 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -233,9 +233,12 @@ struct kimage { unsigned long control_page; /* Flags to indicate special processing */ - unsigned int type : 1; + unsigned int type : 2; #define KEXEC_TYPE_DEFAULT 0 #define KEXEC_TYPE_CRASH 1 +#ifdef CONFIG_QUICK_KEXEC +#define KEXEC_TYPE_QUICK 2 +#endif unsigned int preserve_context : 1; /* If set, we are using file mode kexec syscall */ unsigned int file_mode:1; @@ -296,6 +299,11 @@ extern int kexec_load_disabled; #define KEXEC_FLAGS (KEXEC_ON_CRASH | KEXEC_PRESERVE_CONTEXT) #endif +#ifdef CONFIG_QUICK_KEXEC +#undef KEXEC_FLAGS +#define KEXEC_FLAGS (KEXEC_ON_CRASH | KEXEC_QUICK) +#endif + /* List of defined/legal kexec file flags */ #define KEXEC_FILE_FLAGS (KEXEC_FILE_UNLOAD | KEXEC_FILE_ON_CRASH | \ KEXEC_FILE_NO_INITRAMFS) @@ -305,6 +313,9 @@ extern int kexec_load_disabled; extern struct resource crashk_res; extern struct resource crashk_low_res; extern note_buf_t __percpu *crash_notes; +#ifdef CONFIG_QUICK_KEXEC +extern struct resource quick_kexec_res; +#endif /* flag to track if kexec reboot is in progress */ extern bool kexec_in_progress; diff --git a/include/uapi/linux/kexec.h b/include/uapi/linux/kexec.h index 6d112868272d..dcf9857452da 100644 --- a/include/uapi/linux/kexec.h +++ b/include/uapi/linux/kexec.h @@ -12,6 +12,9 @@ /* kexec flags for different usage scenarios */ #define KEXEC_ON_CRASH 0x00000001 #define KEXEC_PRESERVE_CONTEXT 0x00000002 +#ifdef CONFIG_QUICK_KEXEC +#define KEXEC_QUICK 0x00000004 +#endif #define KEXEC_ARCH_MASK 0xffff0000 /* diff --git a/kernel/kexec.c b/kernel/kexec.c index 68559808fdfa..47dfad722b7c 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -46,6 +46,9 @@ static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, int ret; struct kimage *image; bool kexec_on_panic = flags & KEXEC_ON_CRASH; +#ifdef CONFIG_QUICK_KEXEC + bool kexec_on_quick = flags & KEXEC_QUICK; +#endif if (kexec_on_panic) { /* Verify we have a valid entry point */ @@ -71,6 +74,13 @@ static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, image->type = KEXEC_TYPE_CRASH; } +#ifdef CONFIG_QUICK_KEXEC + if (kexec_on_quick) { + image->control_page = quick_kexec_res.start; + image->type = KEXEC_TYPE_QUICK; + } +#endif + ret = sanity_check_segment_list(image); if (ret) goto out_free_image; diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index b36c9c46cd2c..595a757af656 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -74,6 +74,16 @@ struct resource crashk_low_res = { .desc = IORES_DESC_CRASH_KERNEL }; +#ifdef CONFIG_QUICK_KEXEC +struct resource quick_kexec_res = { + .name = "Quick kexec", + .start = 0, + .end = 0, + .flags = IORESOURCE_BUSY | IORESOURCE_SYSTEM_RAM, + .desc = IORES_DESC_QUICK_KEXEC +}; +#endif + int kexec_should_crash(struct task_struct *p) { /* @@ -470,8 +480,10 @@ static struct page *kimage_alloc_normal_control_pages(struct kimage *image, return pages; } -static struct page *kimage_alloc_crash_control_pages(struct kimage *image, - unsigned int order) + +static struct page *kimage_alloc_special_control_pages(struct kimage *image, + unsigned int order, + unsigned long end) { /* Control pages are special, they are the intermediaries * that are needed while we copy the rest of the pages @@ -501,7 +513,7 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image, size = (1 << order) << PAGE_SHIFT; hole_start = (image->control_page + (size - 1)) & ~(size - 1); hole_end = hole_start + size - 1; - while (hole_end <= crashk_res.end) { + while (hole_end <= end) { unsigned long i; cond_resched(); @@ -536,7 +548,6 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image, return pages; } - struct page *kimage_alloc_control_pages(struct kimage *image, unsigned int order) { @@ -547,8 +558,15 @@ struct page *kimage_alloc_control_pages(struct kimage *image, pages = kimage_alloc_normal_control_pages(image, order); break; case KEXEC_TYPE_CRASH: - pages = kimage_alloc_crash_control_pages(image, order); + pages = kimage_alloc_special_control_pages(image, order, + crashk_res.end); + break; +#ifdef CONFIG_QUICK_KEXEC + case KEXEC_TYPE_QUICK: + pages = kimage_alloc_special_control_pages(image, order, + quick_kexec_res.end); break; +#endif } return pages; @@ -898,11 +916,11 @@ static int kimage_load_normal_segment(struct kimage *image, return result; } -static int kimage_load_crash_segment(struct kimage *image, +static int kimage_load_special_segment(struct kimage *image, struct kexec_segment *segment) { - /* For crash dumps kernels we simply copy the data from - * user space to it's destination. + /* For crash dumps kernels and quick kexec kernels + * we simply copy the data from user space to it's destination. * We do things a page at a time for the sake of kmap. */ unsigned long maddr; @@ -976,8 +994,13 @@ int kimage_load_segment(struct kimage *image, result = kimage_load_normal_segment(image, segment); break; case KEXEC_TYPE_CRASH: - result = kimage_load_crash_segment(image, segment); + result = kimage_load_special_segment(image, segment); + break; +#ifdef CONFIG_QUICK_KEXEC + case KEXEC_TYPE_QUICK: + result = kimage_load_special_segment(image, segment); break; +#endif } return result; -- 2.19.1

1 1

[PATCH 0/7] Improvements and fixes
by Roberto Sassu 07 Aug '20

07 Aug '20

This patch set provides some improvements and fixes. The first three patches solve a permission problem caused by EVM. EVM denies xattr operations also for files that are not appraised by IMA. If only executables are appraised, xattr operations on the other files should be allowed, even if metadata verification fails (for example due to missing security.evm). At the moment, in openEuler we use EVM_ALLOW_METADATA_WRITES to avoid this problem (EVM does not check metadata integrity), but it would be useful to do the verification for example to prevent accidental changes on immutable metadata. The fourth patch enables the choice of the algorithm for the HMAC and ensures that the parameters passed to the functions which handle the HMAC are consistent with the algorithm chosen. The last three patches are simple bug fixes. Roberto Sassu (7): evm: Move hooks outside LSM infrastructure evm: Extend API of post hooks to pass the result of pre hooks evm: Return -EAGAIN to ignore verification failures evm: Propagate choice of HMAC algorithm in evm_crypto.c ima: Fix datalen check in ima_write_data() evm: Fix validation of fake xattr passed by IMA evm: Initialize saved_evm_status fs/attr.c | 7 ++- fs/xattr.c | 64 +++++++++++++++++--------- include/linux/evm.h | 18 +++++--- security/integrity/evm/Kconfig | 32 +++++++++++++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 15 ++++-- security/integrity/evm/evm_main.c | 71 +++++++++++++++++++++-------- security/integrity/ima/ima_fs.c | 2 +- security/integrity/integrity.h | 2 +- security/security.c | 18 ++------ 10 files changed, 158 insertions(+), 72 deletions(-) -- 2.27.GIT

1 7

[PATCH 01/23] ima: Use buffer large enough to store fake IMA xattr for appraisal
by Roberto Sassu 06 Aug '20

06 Aug '20

hulk inclusion category: feature feature: digest-lists --------------------------- A fake IMA xattr is created to perform EVM verification even if security.ima is not present. Appraisal could succeed if EVM status is unknown and the file digest is found in a digest list. This patch allocates a larger buffer to store fake IMA xattrs (struct evm_ima_xattr_data can be used only for SHA1 digests). Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- security/integrity/ima/ima_appraise.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index a11577147022..c6376ec28ccd 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -193,19 +193,19 @@ int ima_appraise_measurement(enum ima_hooks func, struct dentry *dentry = file_dentry(file); struct inode *inode = d_backing_inode(dentry); enum integrity_status status = INTEGRITY_UNKNOWN; - struct evm_ima_xattr_data digest_list_value; + char _buf[sizeof(struct evm_ima_xattr_data) + SHA512_DIGEST_SIZE]; int rc = xattr_len, hash_start = 0; if (!(inode->i_opflags & IOP_XATTR)) return INTEGRITY_UNKNOWN; if (rc == -ENODATA && found_digest && - !(file->f_mode && FMODE_CREATED)) { - digest_list_value.type = EVM_IMA_XATTR_DIGEST_LIST; - digest_list_value.digest[0] = found_digest->algo; - memcpy(&digest_list_value.digest[1], found_digest->digest, + !(file->f_mode & FMODE_CREATED)) { + xattr_value = (struct evm_ima_xattr_data *)_buf; + xattr_value->type = IMA_XATTR_DIGEST_NG; + xattr_value->digest[0] = found_digest->algo; + memcpy(&xattr_value->digest[1], found_digest->digest, hash_digest_size[found_digest->algo]); - xattr_value = &digest_list_value; rc = hash_digest_size[found_digest->algo] + 2; } @@ -283,7 +283,6 @@ int ima_appraise_measurement(enum ima_hooks func, status = INTEGRITY_PASS; break; } - if (!ima_appraise_no_metadata) { cause = "IMA-xattr-untrusted"; status = INTEGRITY_FAIL; -- 2.27.GIT

3 26

[PATCH 01/35] selinux: allow labeling before policy is loaded
by Roberto Sassu 06 Aug '20

06 Aug '20

From: Jonathan Lebon <jlebon(a)redhat.com> mainline inclusion from mainline-v5.5-rc1 commit 3e3e24b42043eceb97ed834102c2d094dfd7aaa6 category: bugfix --------------------------- Currently, the SELinux LSM prevents one from setting the `security.selinux` xattr on an inode without a policy first being loaded. However, this restriction is problematic: it makes it impossible to have newly created files with the correct label before actually loading the policy. This is relevant in distributions like Fedora, where the policy is loaded by systemd shortly after pivoting out of the initrd. In such instances, all files created prior to pivoting will be unlabeled. One then has to relabel them after pivoting, an operation which inherently races with other processes trying to access those same files. Going further, there are use cases for creating the entire root filesystem on first boot from the initrd (e.g. Container Linux supports this today[1], and we'd like to support it in Fedora CoreOS as well[2]). One can imagine doing this in two ways: at the block device level (e.g. laying down a disk image), or at the filesystem level. In the former, labeling can simply be part of the image. But even in the latter scenario, one still really wants to be able to set the right labels when populating the new filesystem. This patch enables this by changing behaviour in the following two ways: 1. allow `setxattr` on mounts without `SBLABEL_MNT` (which is all of them if no policy is loaded yet) 2. don't try to set the in-core inode SID if we're not initialized; instead leave it as `LABEL_INVALID` so that revalidation may be attempted at a later time Note the first hunk of this patch is functionally the same as a previously discussed one[3], though it was part of a larger series which wasn't accepted. Co-developed-by: Victor Kamensky <kamensky(a)cisco.com> Signed-off-by: Victor Kamensky <kamensky(a)cisco.com> Signed-off-by: Jonathan Lebon <jlebon(a)redhat.com> [1] https://coreos.com/os/docs/latest/root-filesystem-placement.html [2] https://github.com/coreos/fedora-coreos-tracker/issues/94 [3] https://www.spinics.net/lists/linux-initramfs/msg04593.html --- security/selinux/hooks.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 452254fd89f8..931546d80211 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3305,7 +3305,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name, } sbsec = inode->i_sb->s_security; - if (!(sbsec->flags & SBLABEL_MNT)) + if (!(sbsec->flags & SBLABEL_MNT) && selinux_state.initialized) return -EOPNOTSUPP; if (!inode_owner_or_capable(inode)) @@ -3387,6 +3387,15 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, return; } + if (!selinux_state.initialized) { + /* If we haven't even been initialized, then we can't validate + * against a policy, so leave the label as invalid. It may + * resolve to a valid label on the next revalidation try if + * we've since initialized. + */ + return; + } + rc = security_context_to_sid_force(&selinux_state, value, size, &newsid); if (rc) { -- 2.27.GIT

3 40

[PATCH 1/5] cgroup: memcg: net: do not associate sock with unrelated cgroup
by Yang Yingliang 04 Aug '20

04 Aug '20

From: Shakeel Butt <shakeelb(a)google.com> [ Upstream commit e876ecc67db80dfdb8e237f71e5b43bb88ae549c ] We are testing network memory accounting in our setup and noticed inconsistent network memory usage and often unrelated cgroups network usage correlates with testing workload. On further inspection, it seems like mem_cgroup_sk_alloc() and cgroup_sk_alloc() are broken in irq context specially for cgroup v1. mem_cgroup_sk_alloc() and cgroup_sk_alloc() can be called in irq context and kind of assumes that this can only happen from sk_clone_lock() and the source sock object has already associated cgroup. However in cgroup v1, where network memory accounting is opt-in, the source sock can be unassociated with any cgroup and the new cloned sock can get associated with unrelated interrupted cgroup. Cgroup v2 can also suffer if the source sock object was created by process in the root cgroup or if sk_alloc() is called in irq context. The fix is to just do nothing in interrupt. WARNING: Please note that about half of the TCP sockets are allocated from the IRQ context, so, memory used by such sockets will not be accouted by the memcg. The stack trace of mem_cgroup_sk_alloc() from IRQ-context: CPU: 70 PID: 12720 Comm: ssh Tainted: 5.6.0-smp-DEV #1 Hardware name: ... Call Trace: <IRQ> dump_stack+0x57/0x75 mem_cgroup_sk_alloc+0xe9/0xf0 sk_clone_lock+0x2a7/0x420 inet_csk_clone_lock+0x1b/0x110 tcp_create_openreq_child+0x23/0x3b0 tcp_v6_syn_recv_sock+0x88/0x730 tcp_check_req+0x429/0x560 tcp_v6_rcv+0x72d/0xa40 ip6_protocol_deliver_rcu+0xc9/0x400 ip6_input+0x44/0xd0 ? ip6_protocol_deliver_rcu+0x400/0x400 ip6_rcv_finish+0x71/0x80 ipv6_rcv+0x5b/0xe0 ? ip6_sublist_rcv+0x2e0/0x2e0 process_backlog+0x108/0x1e0 net_rx_action+0x26b/0x460 __do_softirq+0x104/0x2a6 do_softirq_own_stack+0x2a/0x40 </IRQ> do_softirq.part.19+0x40/0x50 __local_bh_enable_ip+0x51/0x60 ip6_finish_output2+0x23d/0x520 ? ip6table_mangle_hook+0x55/0x160 __ip6_finish_output+0xa1/0x100 ip6_finish_output+0x30/0xd0 ip6_output+0x73/0x120 ? __ip6_finish_output+0x100/0x100 ip6_xmit+0x2e3/0x600 ? ipv6_anycast_cleanup+0x50/0x50 ? inet6_csk_route_socket+0x136/0x1e0 ? skb_free_head+0x1e/0x30 inet6_csk_xmit+0x95/0xf0 __tcp_transmit_skb+0x5b4/0xb20 __tcp_send_ack.part.60+0xa3/0x110 tcp_send_ack+0x1d/0x20 tcp_rcv_state_process+0xe64/0xe80 ? tcp_v6_connect+0x5d1/0x5f0 tcp_v6_do_rcv+0x1b1/0x3f0 ? tcp_v6_do_rcv+0x1b1/0x3f0 __release_sock+0x7f/0xd0 release_sock+0x30/0xa0 __inet_stream_connect+0x1c3/0x3b0 ? prepare_to_wait+0xb0/0xb0 inet_stream_connect+0x3b/0x60 __sys_connect+0x101/0x120 ? __sys_getsockopt+0x11b/0x140 __x64_sys_connect+0x1a/0x20 do_syscall_64+0x51/0x200 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The stack trace of mem_cgroup_sk_alloc() from IRQ-context: Fixes: 2d7580738345 ("mm: memcontrol: consolidate cgroup socket tracking") Fixes: d979a39d7242 ("cgroup: duplicate cgroup reference when cloning sockets") Signed-off-by: Shakeel Butt <shakeelb(a)google.com> Reviewed-by: Roman Gushchin <guro(a)fb.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/cgroup/cgroup.c | 4 ++++ mm/memcontrol.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 78ef274b036e..94f4d6a73d70 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -5928,6 +5928,10 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd) return; } + /* Don't associate the sock with unrelated interrupted task's cgroup. */ + if (in_interrupt()) + return; + rcu_read_lock(); while (true) { diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 5d62c1fada01..f90672e7b4e6 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6328,6 +6328,10 @@ void mem_cgroup_sk_alloc(struct sock *sk) return; } + /* Do not associate the sock with unrelated interrupted task's memcg. */ + if (in_interrupt()) + return; + rcu_read_lock(); memcg = mem_cgroup_from_task(current); if (memcg == root_mem_cgroup) -- 2.25.1

1 4

[PATCH 1/6] net/hinic: Set net device link down when the chip fault
by Yang Yingliang 04 Aug '20

04 Aug '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- Set the fault device link down so that the bond device can fail over to the backup device. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Zengweiliang <zengweiliang.zengweiliang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 4 +- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 22 +++-- drivers/net/ethernet/huawei/hinic/hinic_lld.c | 83 +++++++++++++++++-- .../net/ethernet/huawei/hinic/hinic_main.c | 8 ++ 4 files changed, 100 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw.h b/drivers/net/ethernet/huawei/hinic/hinic_hw.h index 6afe31c9b80e..c4d48ccf8f2a 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hw.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_hw.h @@ -565,7 +565,8 @@ union hinic_fault_hw_mgmt { struct hinic_fault_event { /* enum hinic_fault_type */ u8 type; - u8 rsvd0[3]; + u8 fault_level; /* sdk write fault level for uld event */ + u8 rsvd0[2]; union hinic_fault_hw_mgmt event; }; @@ -653,6 +654,7 @@ enum hinic_event_type { HINIC_EVENT_MCTP_GET_HOST_INFO, HINIC_EVENT_MULTI_HOST_MGMT, HINIC_EVENT_INIT_MIGRATE_PF, + HINIC_EVENT_MGMT_WATCHDOG_EVENT, }; struct hinic_event_info { diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c index 058939d05346..2d6a547c4d34 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c @@ -3537,9 +3537,10 @@ static void fault_event_handler(struct hinic_hwdev *hwdev, void *buf_in, struct hinic_cmd_fault_event *fault_event; struct hinic_event_info event_info; struct hinic_fault_info_node *fault_node; + u8 fault_level; if (in_size != sizeof(*fault_event)) { - sdk_err(hwdev->dev_hdl, "Invalid fault event report, length: %d, should be %ld.\n", + sdk_err(hwdev->dev_hdl, "Invalid fault event report, length: %d, should be %ld\n", in_size, sizeof(*fault_event)); return; } @@ -3547,11 +3548,16 @@ static void fault_event_handler(struct hinic_hwdev *hwdev, void *buf_in, fault_event = buf_in; fault_report_show(hwdev, &fault_event->event); + if (fault_event->event.type == HINIC_FAULT_SRC_HW_MGMT_CHIP) + fault_level = fault_event->event.event.chip.err_level; + else + fault_level = FAULT_LEVEL_FATAL; + if (hwdev->event_callback) { event_info.type = HINIC_EVENT_FAULT; memcpy(&event_info.info, &fault_event->event, sizeof(event_info.info)); - + event_info.info.fault_level = fault_level; hwdev->event_callback(hwdev->event_pri_handle, &event_info); } @@ -3567,11 +3573,7 @@ static void fault_event_handler(struct hinic_hwdev *hwdev, void *buf_in, else if (fault_event->event.type == FAULT_TYPE_PHY_FAULT) fault_node->info.fault_src = HINIC_FAULT_SRC_HW_PHY_FAULT; - if (fault_node->info.fault_src == HINIC_FAULT_SRC_HW_MGMT_CHIP) - fault_node->info.fault_lev = - fault_event->event.event.chip.err_level; - else - fault_node->info.fault_lev = FAULT_LEVEL_FATAL; + fault_node->info.fault_lev = fault_level; memcpy(&fault_node->info.fault_data.hw_mgmt, &fault_event->event.event, sizeof(union hinic_fault_hw_mgmt)); @@ -3811,10 +3813,16 @@ static void mgmt_watchdog_timeout_event_handler(struct hinic_hwdev *hwdev, void *buf_out, u16 *out_size) { struct hinic_fault_info_node *fault_node; + struct hinic_event_info event_info = { 0 }; sw_watchdog_timeout_info_show(hwdev, buf_in, in_size, buf_out, out_size); + if (hwdev->event_callback) { + event_info.type = HINIC_EVENT_MGMT_WATCHDOG_EVENT; + hwdev->event_callback(hwdev->event_pri_handle, &event_info); + } + /* refresh history fault info */ fault_node = kzalloc(sizeof(*fault_node), GFP_KERNEL); if (!fault_node) { diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index 044d0df996e5..412f4c8a93ea 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -1793,18 +1793,11 @@ static void __multi_host_mgmt(struct hinic_pcidev *dev, } } -void hinic_event_process(void *adapter, struct hinic_event_info *event) +static void send_uld_dev_event(struct hinic_pcidev *dev, + struct hinic_event_info *event) { - struct hinic_pcidev *dev = adapter; enum hinic_service_type type; - if (event->type == HINIC_EVENT_FMW_ACT_NTC) - return hinic_sync_time_to_fmw(dev); - else if (event->type == HINIC_EVENT_MCTP_GET_HOST_INFO) - return __mctp_get_host_info(dev, &event->mctp_info); - else if (event->type == HINIC_EVENT_MULTI_HOST_MGMT) - return __multi_host_mgmt(dev, &event->mhost_mgmt); - for (type = SERVICE_T_NIC; type < SERVICE_T_MAX; type++) { if (test_and_set_bit(type, &dev->state)) { sdk_warn(&dev->pcidev->dev, "Event: 0x%x can't handler, %s is in detach\n", @@ -1819,6 +1812,78 @@ void hinic_event_process(void *adapter, struct hinic_event_info *event) } } +static void send_event_to_all_pf(struct hinic_pcidev *dev, + struct hinic_event_info *event) +{ + struct hinic_pcidev *des_dev = NULL; + + lld_dev_hold(); + list_for_each_entry(des_dev, &dev->chip_node->func_list, node) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag)) + continue; + + if (hinic_func_type(des_dev->hwdev) == TYPE_VF) + continue; + + send_uld_dev_event(des_dev, event); + } + lld_dev_put(); +} + +static void send_event_to_dst_pf(struct hinic_pcidev *dev, u16 func_id, + struct hinic_event_info *event) +{ + struct hinic_pcidev *des_dev = NULL; + + lld_dev_hold(); + list_for_each_entry(des_dev, &dev->chip_node->func_list, node) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag)) + continue; + + if (hinic_func_type(des_dev->hwdev) == TYPE_VF) + continue; + + if (hinic_global_func_id(des_dev->hwdev) == func_id) { + send_uld_dev_event(des_dev, event); + break; + } + } + lld_dev_put(); +} + +void hinic_event_process(void *adapter, struct hinic_event_info *event) +{ + struct hinic_pcidev *dev = adapter; + u16 func_id; + + switch (event->type) { + case HINIC_EVENT_FMW_ACT_NTC: + hinic_sync_time_to_fmw(dev); + break; + case HINIC_EVENT_MCTP_GET_HOST_INFO: + __mctp_get_host_info(dev, &event->mctp_info); + break; + case HINIC_EVENT_MULTI_HOST_MGMT: + __multi_host_mgmt(dev, &event->mhost_mgmt); + break; + case HINIC_EVENT_FAULT: + if (event->info.fault_level == FAULT_LEVEL_SERIOUS_FLR && + event->info.event.chip.func_id < HINIC_MAX_PF_NUM) { + func_id = event->info.event.chip.func_id; + send_event_to_dst_pf(adapter, func_id, event); + } else { + send_uld_dev_event(adapter, event); + } + break; + case HINIC_EVENT_MGMT_WATCHDOG_EVENT: + send_event_to_all_pf(adapter, event); + break; + default: + send_uld_dev_event(adapter, event); + break; + } +} + static int mapping_bar(struct pci_dev *pdev, struct hinic_pcidev *pci_adapter) { u32 db_dwqe_size; diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index 8dc7b555f0bf..e0635287bf05 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -3026,8 +3026,13 @@ void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, break; case HINIC_EVENT_HEART_LOST: hinic_heart_lost(nic_dev); + hinic_link_status_change(nic_dev, false); break; case HINIC_EVENT_FAULT: + if (event->info.fault_level == FAULT_LEVEL_SERIOUS_FLR && + event->info.event.chip.func_id == + hinic_global_func_id(lld_dev->hwdev)) + hinic_link_status_change(nic_dev, false); break; case HINIC_EVENT_DCB_STATE_CHANGE: if (nic_dev->default_cos_id == event->dcb_state.default_cos) @@ -3047,6 +3052,9 @@ void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, case HINIC_EVENT_PORT_MODULE_EVENT: hinic_port_module_event_handler(nic_dev, event); break; + case HINIC_EVENT_MGMT_WATCHDOG_EVENT: + hinic_link_status_change(nic_dev, false); + break; default: break; } -- 2.25.1

1 5

[PATCH 00/18] stable 4.19.136
by Yang Yingliang 04 Aug '20

04 Aug '20

Cong Wang (1): qrtr: orphan socket in qrtr_release() Dan Carpenter (1): AX.25: Prevent integer overflows in connect and sendmsg David Howells (1): rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA Greg Kroah-Hartman (1): Linux 4.19.136 Kuniyuki Iwashima (2): udp: Copy has_conns in reuseport_grow(). udp: Improve load balancing for SO_REUSEPORT. Miaohe Lin (1): net: udp: Fix wrong clean up for IS_UDPLITE macro Peilin Ye (2): AX.25: Fix out-of-bounds read in ax25_connect() AX.25: Prevent out-of-bounds read in ax25_sendmsg() Peng Fan (1): regmap: debugfs: check count when read regmap file Subash Abhinov Kasiviswanathan (1): dev: Defer free of skbs in flush_backlog Wei Yongjun (1): ip6_gre: fix null-ptr-deref in ip6gre_init_net() Weilong Chen (1): rtnetlink: Fix memory(net_device) leak when ->newlink fails Xie He (1): drivers/net/wan/x25_asy: Fix to make it work Xin Long (2): sctp: shrink stream outq only when new outcnt < old outcnt sctp: shrink stream outq when fails to do addstream reconf Xiongfeng Wang (1): net-sysfs: add a newline when printing 'tx_timeout' by sysfs Yuchung Cheng (1): tcp: allow at most one TLP probe per flight Makefile | 2 +- drivers/base/regmap/regmap-debugfs.c | 6 ++++++ drivers/net/wan/x25_asy.c | 21 ++++++++++++++------- include/linux/tcp.h | 4 +++- net/ax25/af_ax25.c | 10 ++++++++-- net/core/dev.c | 2 +- net/core/net-sysfs.c | 2 +- net/core/rtnetlink.c | 3 ++- net/core/sock_reuseport.c | 1 + net/ipv4/tcp_input.c | 11 ++++++----- net/ipv4/tcp_output.c | 13 ++++++++----- net/ipv4/udp.c | 17 ++++++++++------- net/ipv6/ip6_gre.c | 11 ++++++----- net/ipv6/udp.c | 17 ++++++++++------- net/qrtr/qrtr.c | 1 + net/rxrpc/recvmsg.c | 2 +- net/rxrpc/sendmsg.c | 2 +- net/sctp/stream.c | 27 ++++++++++++++++++--------- 18 files changed, 98 insertions(+), 54 deletions(-) -- 2.25.1

1 18

[PATCH 00/87] stable 4.19.135
by Yang Yingliang 03 Aug '20

03 Aug '20

Alexander Lobakin (1): qed: suppress "don't support RoCE & iWARP" flooding on HW init Arnd Bergmann (1): x86: math-emu: Fix up 'cmp' insn for clang ias Ben Skeggs (1): drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout Boris Burkov (1): btrfs: fix mount failure caused by race with umount Caiyuan Xie (1): HID: alps: support devices with report id 2 Chen-Yu Tsai (1): drm: sun4i: hdmi: Fix inverted HPD result Christophe JAILLET (1): hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path Chu Lin (1): hwmon: (adm1275) Make sure we are reading enough data for different chips Chunfeng Yun (1): usb: xhci-mtk: fix the failure of bandwidth allocation Cong Wang (1): bonding: check return value of register_netdevice() in bond_newlink() Cristian Marussi (1): hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() Dinghao Liu (1): dmaengine: tegra210-adma: Fix runtime PM imbalance on error Douglas Anderson (1): soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner Evgeny Novikov (2): hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init() Fangrui Song (1): Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation Federico Ricchiuto (1): HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override Filipe Manana (1): btrfs: fix double free on ulist after backref resolution failure Forest Crossman (1): usb: xhci: Fix ASM2142/ASM3142 DMA addressing Gavin Shan (1): drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups() Geert Uytterhoeven (1): ASoC: qcom: Drop HAS_DMA dependency to fix link failure George Kennedy (1): ax88172a: fix ax88172a_unbind() failures Greg Kroah-Hartman (1): Linux 4.19.135 Hans de Goede (3): ASoC: rt5670: Correct RT5670_LDO_SEL_MASK HID: apple: Disable Fn-key key-re-mapping on clone keyboards ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10 Hugh Dickins (1): mm/memcg: fix refcount error while moving and swapping Ian Abbott (4): staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift Ilya Katsnelson (1): Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen Jacky Hu (1): pinctrl: amd: fix npins for uart0 in kerncz_groups Joerg Roedel (1): x86, vmlinux.lds: Page-align end of ..page_aligned sections John David Anglin (1): parisc: Add atomic64_set_release() define to avoid CPU soft lockups Jon Maloy (1): tipc: clean up skb list lock handling on send path Leonid Ravich (1): dmaengine: ioat setting ioat timeout as module parameter Liu Jian (2): ieee802154: fix one possible memleak in adf7242_probe mlxsw: destroy workqueue when trap_register in mlxsw_emad_init Marc Kleine-Budde (1): regmap: dev_get_regmap_match(): fix string comparison Mark O'Donovan (1): ath9k: Fix regression with Atheros 9271 Markus Theil (1): mac80211: allow rx of mesh eapol frames with default rx key Matthew Gerlach (1): fpga: dfl: fix bug in port reset handshake Matthew Howell (1): serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X Max Filippov (2): xtensa: fix __sync_fetch_and_{and,or}_4 declarations xtensa: update *pos in cpuinfo_op.next Merlijn Wajer (1): Input: add `SW_MACHINE_COVER` Michael J. Ruhl (1): io-mapping: indicate mapping failure Miklos Szeredi (1): fuse: fix weird page warning Mikulas Patocka (1): dm integrity: fix integrity recalculation that is improperly skipped Muchun Song (1): mm: memcg/slab: fix memory leak at non-root kmem_cache destroy Navid Emamdoost (2): gpio: arizona: handle pm_runtime_get_sync failure case gpio: arizona: put pm_runtime in case of failure Oleg Nesterov (1): uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression Olga Kornievskaia (1): SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion") Palmer Dabbelt (1): RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw Paweł Gronowski (1): drm/amdgpu: Fix NULL dereference in dpm sysfs handlers Pi-Hsun Shih (1): scripts/decode_stacktrace: strip basepath from all paths Qiu Wenbo (1): drm/amd/powerplay: fix a crash when overclocking Vega M Qiujun Huang (1): ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Robbie Ko (1): btrfs: fix page leaks after failure to lock page for delalloc Rodrigo Rivas Costa (1): HID: steam: fixes race in handling device list. Roman Gushchin (1): mm: memcg/slab: synchronize access to kmem_cache dying flag using a spinlock Rustam Kovhaev (1): staging: wlan-ng: properly check endpoint types Serge Semin (1): serial: 8250_mtk: Fix high-speed baud rates clamping Sergey Organov (1): net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration Stefano Garzarella (1): scripts/gdb: fix lx-symbols 'gdb.error' while loading modules Steve French (1): Revert "cifs: Fix the target file was deleted when rename failed." Taehee Yoo (1): bonding: check error value of register_netdevice() immediately Takashi Iwai (1): ALSA: info: Drop WARN_ON() from buffer NULL sanity check Tetsuo Handa (3): binder: Don't use mmput() from shrinker function. fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. vt: Reject zero-sized screen buffer size. Thomas Gleixner (1): irqdomain/treewide: Keep firmware node unconditionally allocated Tom Rix (2): scsi: scsi_transport_spi: Fix function pointer check net: sky2: initialize return of gm_phy_read Vasundhara Volam (1): bnxt_en: Fix race when modifying pause settings. Vladimir Oltean (1): spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when it's not ours Wang Hai (2): net: smc91x: Fix possible memory leak in smc_drv_probe() net: ethernet: ave: Fix error returns in ave_init Will Deacon (1): arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP Wolfram Sang (1): i2c: rcar: always clear ICSAR to avoid side effects Xie He (1): drivers/net/wan/lapbether: Fixed the value of hard_header_len Yang Yingliang (2): IB/umem: fix reference count leak in ib_umem_odp_get() serial: 8250: fix null-ptr-deref in serial8250_start_tx() guodeqing (1): ipvs: fix the connection sync failed in some cases leilk.liu (1): spi: mediatek: use correct SPI_CFG2_REG MACRO Makefile | 4 +- arch/arm64/kernel/debug-monitors.c | 4 +- arch/parisc/include/asm/atomic.h | 2 + arch/riscv/include/asm/barrier.h | 10 ++- arch/x86/kernel/apic/io_apic.c | 10 +-- arch/x86/kernel/apic/msi.c | 18 +++-- arch/x86/kernel/apic/vector.c | 1 - arch/x86/kernel/vmlinux.lds.S | 1 + arch/x86/math-emu/wm_sqrt.S | 2 +- arch/x86/platform/uv/uv_irq.c | 3 +- arch/xtensa/kernel/setup.c | 3 +- arch/xtensa/kernel/xtensa_ksyms.c | 4 +- drivers/android/binder_alloc.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/dma/ioat/dma.c | 12 ++++ drivers/dma/ioat/dma.h | 2 - drivers/dma/tegra210-adma.c | 5 +- drivers/firmware/psci_checker.c | 5 +- drivers/fpga/dfl-afu-main.c | 3 +- drivers/gpio/gpio-arizona.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 +-- .../drm/amd/powerplay/smumgr/vegam_smumgr.c | 10 +-- .../gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c | 4 +- .../drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 4 +- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +- drivers/hid/hid-alps.c | 2 + drivers/hid/hid-apple.c | 18 +++++ drivers/hid/hid-steam.c | 6 +- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 +++ drivers/hwmon/aspeed-pwm-tacho.c | 2 + drivers/hwmon/pmbus/adm1275.c | 10 ++- drivers/hwmon/scmi-hwmon.c | 2 +- drivers/i2c/busses/i2c-rcar.c | 3 + drivers/infiniband/core/umem_odp.c | 3 +- drivers/input/mouse/synaptics.c | 1 + drivers/iommu/amd_iommu.c | 5 +- drivers/iommu/intel_irq_remapping.c | 2 +- drivers/md/dm-integrity.c | 4 +- drivers/md/dm.c | 17 +++++ drivers/net/bonding/bond_main.c | 10 ++- drivers/net/bonding/bond_netlink.c | 3 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 +- drivers/net/ethernet/marvell/sky2.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 +- drivers/net/ethernet/smsc/smc91x.c | 4 +- drivers/net/ethernet/socionext/sni_ave.c | 2 +- drivers/net/hippi/rrunner.c | 2 +- drivers/net/ieee802154/adf7242.c | 4 +- drivers/net/phy/dp83640.c | 4 ++ drivers/net/usb/ax88172a.c | 1 + drivers/net/wan/lapbether.c | 9 ++- drivers/net/wireless/ath/ath9k/hif_usb.c | 52 ++++++++++---- drivers/net/wireless/ath/ath9k/hif_usb.h | 5 ++ drivers/pci/controller/vmd.c | 5 +- drivers/pinctrl/pinctrl-amd.h | 2 +- drivers/scsi/scsi_transport_spi.c | 2 +- drivers/soc/qcom/rpmh.c | 8 +-- drivers/spi/spi-fsl-dspi.c | 4 +- drivers/spi/spi-mt65xx.c | 15 ++-- .../staging/comedi/drivers/addi_apci_1032.c | 20 ++++-- .../staging/comedi/drivers/addi_apci_1500.c | 24 +++++-- .../staging/comedi/drivers/addi_apci_1564.c | 20 ++++-- drivers/staging/comedi/drivers/ni_6527.c | 2 +- drivers/staging/wlan-ng/prism2usb.c | 16 ++++- drivers/tty/serial/8250/8250_core.c | 2 +- drivers/tty/serial/8250/8250_exar.c | 12 +++- drivers/tty/serial/8250/8250_mtk.c | 18 +++++ drivers/tty/vt/vt.c | 29 +++++--- drivers/usb/gadget/udc/gr_udc.c | 7 +- drivers/usb/host/xhci-mtk-sch.c | 4 ++ drivers/usb/host/xhci-pci.c | 3 + drivers/video/fbdev/core/bitblit.c | 4 +- drivers/video/fbdev/core/fbcon_ccw.c | 4 +- drivers/video/fbdev/core/fbcon_cw.c | 4 +- drivers/video/fbdev/core/fbcon_ud.c | 4 +- fs/btrfs/backref.c | 1 + fs/btrfs/extent_io.c | 3 +- fs/btrfs/volumes.c | 8 +++ fs/cifs/inode.c | 10 +-- fs/fuse/dev.c | 3 +- fs/nfs/direct.c | 13 ++-- fs/nfs/file.c | 1 - include/asm-generic/vmlinux.lds.h | 5 +- include/linux/device-mapper.h | 1 + include/linux/io-mapping.h | 5 +- include/linux/mod_devicetable.h | 2 +- include/sound/rt5670.h | 1 + include/uapi/linux/input-event-codes.h | 3 +- kernel/events/uprobes.c | 2 +- mm/memcontrol.c | 4 +- mm/slab_common.c | 50 ++++++++++--- net/mac80211/rx.c | 26 +++++++ net/netfilter/ipvs/ip_vs_sync.c | 12 ++-- net/tipc/bcast.c | 8 +-- net/tipc/group.c | 4 +- net/tipc/link.c | 12 ++-- net/tipc/node.c | 7 +- net/tipc/socket.c | 12 ++-- scripts/decode_stacktrace.sh | 4 +- scripts/gdb/linux/symbols.py | 2 +- sound/core/info.c | 4 +- sound/soc/codecs/rt5670.c | 71 +++++++++++++++---- sound/soc/codecs/rt5670.h | 2 +- sound/soc/qcom/Kconfig | 2 +- 105 files changed, 584 insertions(+), 225 deletions(-) -- 2.25.1

1 87

[PATCH] netfilter: nat: check the bounds of nf_nat_l3protos and nf_nat_l4protos
by Yang Yingliang 29 Jul '20

29 Jul '20

hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- famliy can be passed from user space and will be out of range of nf_nat_l3protos or nf_nat_l4protos, so we need check the family when call __nf_nat_l3proto_find() or __nf_nat_l4proto_find(). nfnetlink_parse_nat_setup() need return EAGAIN, if __nf_nat_l3proto_find() returns null, so we return a error number to distinguish this case. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 4 +++- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 4 +++- net/netfilter/nf_nat_core.c | 21 ++++++++++++++++++++- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c index 6115bf1ff6f0..52e3f9c7bc69 100644 --- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c @@ -218,6 +218,8 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb, return 1; l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, inside->ip.protocol); + if (!l4proto) + return 1; if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp), l4proto, &ct->tuplehash[!dir].tuple, !manip)) return 0; @@ -234,7 +236,7 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb, /* Change outer to look like the reply to an incoming packet */ nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, 0); - if (!nf_nat_ipv4_manip_pkt(skb, 0, l4proto, &target, manip)) + if (l4proto && !nf_nat_ipv4_manip_pkt(skb, 0, l4proto, &target, manip)) return 0; return 1; diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c index ca6d38698b1a..bf25263b2dcd 100644 --- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c @@ -228,6 +228,8 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, return 1; l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, inside->ip6.nexthdr); + if (!l4proto) + return 1; if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6), l4proto, &ct->tuplehash[!dir].tuple, !manip)) return 0; @@ -245,7 +247,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, IPPROTO_ICMPV6); - if (!nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip)) + if (l4proto && !nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip)) return 0; return 1; diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index 2268b10a9dcf..f1576e46ee2c 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -64,12 +64,18 @@ struct nat_net { inline const struct nf_nat_l3proto * __nf_nat_l3proto_find(u8 family) { + if (unlikely(family >= NFPROTO_NUMPROTO)) + return ERR_PTR(-EPROTONOSUPPORT); + return rcu_dereference(nf_nat_l3protos[family]); } inline const struct nf_nat_l4proto * __nf_nat_l4proto_find(u8 family, u8 protonum) { + if (unlikely(family >= NFPROTO_NUMPROTO || nf_nat_l4protos[family] == NULL)) + return NULL; + return rcu_dereference(nf_nat_l4protos[family][protonum]); } EXPORT_SYMBOL_GPL(__nf_nat_l4proto_find); @@ -90,7 +96,7 @@ static void __nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl) family = nf_ct_l3num(ct); l3proto = __nf_nat_l3proto_find(family); - if (l3proto == NULL) + if (IS_ERR_OR_NULL(l3proto)) return; dir = CTINFO2DIR(ctinfo); @@ -333,8 +339,12 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple, rcu_read_lock(); l3proto = __nf_nat_l3proto_find(orig_tuple->src.l3num); + if (IS_ERR_OR_NULL(l3proto)) + goto out; l4proto = __nf_nat_l4proto_find(orig_tuple->src.l3num, orig_tuple->dst.protonum); + if (!l4proto) + goto out; /* 1) If this srcip/proto/src-proto-part is currently mapped, * and that same mapping gives a unique tuple within the given @@ -509,8 +519,12 @@ static unsigned int nf_nat_manip_pkt(struct sk_buff *skb, struct nf_conn *ct, nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); l3proto = __nf_nat_l3proto_find(target.src.l3num); + if (IS_ERR_OR_NULL(l3proto)) + return NF_DROP; l4proto = __nf_nat_l4proto_find(target.src.l3num, target.dst.protonum); + if (!l4proto) + return NF_DROP; if (!l3proto->manip_pkt(skb, 0, l4proto, &target, mtype)) return NF_DROP; @@ -816,6 +830,9 @@ static int nfnetlink_parse_nat_proto(struct nlattr *attr, return err; l4proto = __nf_nat_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); + if (!l4proto) + return -EPROTONOSUPPORT; + if (l4proto->nlattr_to_range) err = l4proto->nlattr_to_range(tb, range); @@ -876,6 +893,8 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct, l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct)); if (l3proto == NULL) return -EAGAIN; + if (IS_ERR(l3proto)) + return PTR_ERR(l3proto); /* No NAT information has been passed, allocate the null-binding */ if (attr == NULL) -- 2.25.1

1 0