- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP2 0/2] Fix CVE-2024-26764
by ZhaoLong Wang 13 Apr '24

13 Apr '24

Bart Van Assche (2): fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion fs/aio.c | 17 ++++++++++++++--- include/linux/fs.h | 2 ++ 2 files changed, 16 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-26764
by ZhaoLong Wang 13 Apr '24

13 Apr '24

Bart Van Assche (2): fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion fs/aio.c | 17 ++++++++++++++--- include/linux/fs.h | 2 ++ 2 files changed, 16 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS 0/2] Fix CVE-2024-26764
by ZhaoLong Wang 13 Apr '24

13 Apr '24

Bart Van Assche (2): fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion fs/aio.c | 17 ++++++++++++++--- include/linux/fs.h | 2 ++ 2 files changed, 16 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-26764
by ZhaoLong Wang 13 Apr '24

13 Apr '24

Bart Van Assche (2): fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion fs/aio.c | 17 ++++++++++++++--- include/linux/fs.h | 2 ++ 2 files changed, 16 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-26764
by ZhaoLong Wang 13 Apr '24

13 Apr '24

Bart Van Assche (2): fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion fs/aio.c | 17 ++++++++++++++--- include/linux/fs.h | 2 ++ 2 files changed, 16 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-26787
by Yi Yang 13 Apr '24

13 Apr '24

Christophe Kerello (1): mmc: mmci: stm32: fix DMA API overlapping mappings warning Yann Gautier (1): mmc: mmci: stm32: use a buffer for unaligned DMA requests drivers/mmc/host/mmci_stm32_sdmmc.c | 112 +++++++++++++++++++++++----- 1 file changed, 95 insertions(+), 17 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] net/sched: act_mirred: don't override retval if we already lost the skb
by Zhengchao Shao 13 Apr '24

13 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ CVE: CVE-2024-26739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 336db2c938b5..0909c0d7b54f 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -305,15 +305,18 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, } err = tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb2); - if (err) { -out: + if (err) qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); - if (tcf_mirred_is_act_redirect(m_eaction)) - retval = TC_ACT_SHOT; - } __this_cpu_dec(mirred_rec_level); return retval; + +out: + tcf_action_inc_overlimit_qstats(&m->common); + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + __this_cpu_dec(mirred_nest_level); + return retval; } static void tcf_stats_update(struct tc_action *a, u64 bytes, u32 packets, -- 2.34.1

2 1

[PATCH OLK-5.10] net/sched: act_mirred: don't override retval if we already lost the skb
by Zhengchao Shao 13 Apr '24

13 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ CVE: CVE-2024-26739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 66c9f356a876..3af7e5e15c30 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -319,15 +319,19 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, } err = tcf_mirred_forward(at_ingress, want_ingress, skb2); - if (err) { -out: + if (err) tcf_action_inc_overlimit_qstats(&m->common); - if (tcf_mirred_is_act_redirect(m_eaction)) - retval = TC_ACT_SHOT; - } + __this_cpu_dec(mirred_nest_level); return retval; + +out: + tcf_action_inc_overlimit_qstats(&m->common); + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + __this_cpu_dec(mirred_nest_level); + return retval; } static void tcf_stats_update(struct tc_action *a, u64 bytes, u64 packets, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: act_mirred: don't override retval if we already lost the skb
by Zhengchao Shao 13 Apr '24

13 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ CVE: CVE-2024-26739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 336db2c938b5..0909c0d7b54f 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -305,15 +305,18 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, } err = tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb2); - if (err) { -out: + if (err) qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); - if (tcf_mirred_is_act_redirect(m_eaction)) - retval = TC_ACT_SHOT; - } __this_cpu_dec(mirred_rec_level); return retval; + +out: + tcf_action_inc_overlimit_qstats(&m->common); + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + __this_cpu_dec(mirred_nest_level); + return retval; } static void tcf_stats_update(struct tc_action *a, u64 bytes, u32 packets, -- 2.34.1

2 1

[PATCH OLK-5.10] net/sched: act_mirred: don't override retval if we already lost the skb
by Zhengchao Shao 13 Apr '24

13 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ CVE: CVE-2024-26739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 91a19460cb57..97a4a1fc7c4e 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -323,15 +323,18 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, } err = tcf_mirred_forward(want_ingress, skb2); - if (err) { -out: + if (err) tcf_action_inc_overlimit_qstats(&m->common); - if (tcf_mirred_is_act_redirect(m_eaction)) - retval = TC_ACT_SHOT; - } __this_cpu_dec(mirred_nest_level); return retval; + +out: + tcf_action_inc_overlimit_qstats(&m->common); + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + __this_cpu_dec(mirred_nest_level); + return retval; } static void tcf_stats_update(struct tc_action *a, u64 bytes, u64 packets, -- 2.34.1

2 1