- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
by Long Li 09 Apr '24

09 Apr '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.81 commit 999daf367b924fdf14e9d83e034ee0f86bc17ec6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932W8 CVE: CVE-2024-26592 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 38d20c62903d669693a1869aa68c4dd5674e2544 ] The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_connection() function. Cc: stable(a)vger.kernel.org Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-22991 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: fs/ksmbd/transport_tcp.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/connection.c | 6 ------ fs/ksmbd/connection.h | 1 - fs/ksmbd/transport_rdma.c | 11 ++++++----- fs/ksmbd/transport_tcp.c | 13 +++++++------ 4 files changed, 13 insertions(+), 18 deletions(-) diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c index f0818e764230..d48d177cba6b 100644 --- a/fs/ksmbd/connection.c +++ b/fs/ksmbd/connection.c @@ -434,13 +434,7 @@ static void stop_sessions(void) again: down_read(&conn_list_lock); list_for_each_entry(conn, &conn_list, conns_list) { - struct task_struct *task; - t = conn->transport; - task = t->handler; - if (task) - ksmbd_debug(CONN, "Stop session handler %s/%d\n", - task->comm, task_pid_nr(task)); ksmbd_conn_set_exiting(conn); if (t->ops->shutdown) { up_read(&conn_list_lock); diff --git a/fs/ksmbd/connection.h b/fs/ksmbd/connection.h index 75a1849ba828..9708ba99d8a5 100644 --- a/fs/ksmbd/connection.h +++ b/fs/ksmbd/connection.h @@ -128,7 +128,6 @@ struct ksmbd_transport_ops { struct ksmbd_transport { struct ksmbd_conn *conn; struct ksmbd_transport_ops *ops; - struct task_struct *handler; }; #define KSMBD_TCP_RECV_TIMEOUT (7 * HZ) diff --git a/fs/ksmbd/transport_rdma.c b/fs/ksmbd/transport_rdma.c index d3b60b833a81..2a8640ce1107 100644 --- a/fs/ksmbd/transport_rdma.c +++ b/fs/ksmbd/transport_rdma.c @@ -1976,6 +1976,7 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) { struct smb_direct_transport *t; + struct task_struct *handler; int ret; if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { @@ -1993,11 +1994,11 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) if (ret) goto out_err; - KSMBD_TRANS(t)->handler = kthread_run(ksmbd_conn_handler_loop, - KSMBD_TRANS(t)->conn, "ksmbd:r%u", - smb_direct_port); - if (IS_ERR(KSMBD_TRANS(t)->handler)) { - ret = PTR_ERR(KSMBD_TRANS(t)->handler); + handler = kthread_run(ksmbd_conn_handler_loop, + KSMBD_TRANS(t)->conn, "ksmbd:r%u", + smb_direct_port); + if (IS_ERR(handler)) { + ret = PTR_ERR(handler); pr_err("Can't start thread\n"); goto out_err; } diff --git a/fs/ksmbd/transport_tcp.c b/fs/ksmbd/transport_tcp.c index d34812d140eb..79b40f26587c 100644 --- a/fs/ksmbd/transport_tcp.c +++ b/fs/ksmbd/transport_tcp.c @@ -183,6 +183,7 @@ static int ksmbd_tcp_new_connection(struct socket *client_sk) struct sockaddr *csin; int rc = 0; struct tcp_transport *t; + struct task_struct *handler; t = alloc_transport(client_sk); if (!t) @@ -195,13 +196,13 @@ static int ksmbd_tcp_new_connection(struct socket *client_sk) goto out_error; } - KSMBD_TRANS(t)->handler = kthread_run(ksmbd_conn_handler_loop, - KSMBD_TRANS(t)->conn, - "ksmbd:%u", - ksmbd_tcp_get_port(csin)); - if (IS_ERR(KSMBD_TRANS(t)->handler)) { + handler = kthread_run(ksmbd_conn_handler_loop, + KSMBD_TRANS(t)->conn, + "ksmbd:%u", + ksmbd_tcp_get_port(csin)); + if (IS_ERR(handler)) { pr_err("cannot start conn thread\n"); - rc = PTR_ERR(KSMBD_TRANS(t)->handler); + rc = PTR_ERR(handler); free_transport(t); } return rc; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP2] dmaengine: ti: edma: Add some null pointer checks to the edma_probe
by GUO Zihua 09 Apr '24

09 Apr '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v5.10.211 commit c432094aa7c9970f2fa10d2305d550d3810657ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MP CVE: CVE-2024-26771 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6e2276203ac9ff10fc76917ec9813c660f627369 ] devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/dma/ti/edma.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- drivers/dma/ti/edma.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c index 35d81bd857f1..ddeba9a7c1cf 100644 --- a/drivers/dma/ti/edma.c +++ b/drivers/dma/ti/edma.c @@ -2462,6 +2462,11 @@ static int edma_probe(struct platform_device *pdev) if (irq >= 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name, ecc); if (ret) { @@ -2478,6 +2483,11 @@ static int edma_probe(struct platform_device *pdev) if (irq >= 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name, ecc); if (ret) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] ksmbd: fix CVE-2024-26594
by Long Li 09 Apr '24

09 Apr '24

This patch set fix CVE-2024-26594. Dawei Li (1): ksmbd: Remove duplicated codes Namjae Jeon (1): ksmbd: validate mech token in session setup Yang Yingliang (1): ksmbd: switch to use kmemdup_nul() helper fs/ksmbd/asn1.c | 32 +++++++++++++++++--------------- fs/ksmbd/connection.h | 1 + fs/ksmbd/smb2pdu.c | 22 +++++++++++++++++----- 3 files changed, 35 insertions(+), 20 deletions(-) -- 2.31.1

2 4

[PATCH openEuler-22.03-LTS-SP1] dmaengine: ti: edma: Add some null pointer checks to the edma_probe
by GUO Zihua 09 Apr '24

09 Apr '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v5.10.211 commit c432094aa7c9970f2fa10d2305d550d3810657ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MP CVE: CVE-2024-26771 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6e2276203ac9ff10fc76917ec9813c660f627369 ] devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/dma/ti/edma.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- drivers/dma/ti/edma.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c index 35d81bd857f1..ddeba9a7c1cf 100644 --- a/drivers/dma/ti/edma.c +++ b/drivers/dma/ti/edma.c @@ -2462,6 +2462,11 @@ static int edma_probe(struct platform_device *pdev) if (irq >= 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name, ecc); if (ret) { @@ -2478,6 +2483,11 @@ static int edma_probe(struct platform_device *pdev) if (irq >= 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name, ecc); if (ret) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] dmaengine: ti: edma: Add some null pointer checks to the edma_probe
by GUO Zihua 09 Apr '24

09 Apr '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v5.10.211 commit c432094aa7c9970f2fa10d2305d550d3810657ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MP CVE: CVE-2024-26771 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6e2276203ac9ff10fc76917ec9813c660f627369 ] devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/dma/ti/edma.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- drivers/dma/ti/edma.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c index 35d81bd857f1..ddeba9a7c1cf 100644 --- a/drivers/dma/ti/edma.c +++ b/drivers/dma/ti/edma.c @@ -2462,6 +2462,11 @@ static int edma_probe(struct platform_device *pdev) if (irq >= 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name, ecc); if (ret) { @@ -2478,6 +2483,11 @@ static int edma_probe(struct platform_device *pdev) if (irq >= 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name, ecc); if (ret) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2024-26669
by Zhengchao Shao 09 Apr '24

09 Apr '24

fix CVE-2024-26669. Ido Schimmel (1): net/sched: flower: Fix chain template offload Zhengchao Shao (1): net/sched: flower: Fix kabi change net/sched/cls_api.c | 27 +++++++++++++++++++++++++++ net/sched/cls_flower.c | 23 +++++++++++++++++++++++ 2 files changed, 50 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10] dmaengine: ti: edma: Add some null pointer checks to the edma_probe
by GUO Zihua 09 Apr '24

09 Apr '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v5.10.211 commit c432094aa7c9970f2fa10d2305d550d3810657ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MP CVE: CVE-2024-26771 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6e2276203ac9ff10fc76917ec9813c660f627369 ] devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- drivers/dma/ti/edma.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c index a1adc8d91fd8..69292d4a0c44 100644 --- a/drivers/dma/ti/edma.c +++ b/drivers/dma/ti/edma.c @@ -2462,6 +2462,11 @@ static int edma_probe(struct platform_device *pdev) if (irq > 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name, ecc); if (ret) { @@ -2478,6 +2483,11 @@ static int edma_probe(struct platform_device *pdev) if (irq > 0) { irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint", dev_name(dev)); + if (!irq_name) { + ret = -ENOMEM; + goto err_disable_pm; + } + ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name, ecc); if (ret) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-26809
by Ziyang Xuan 09 Apr '24

09 Apr '24

Patchset of CVE-2024-26809. Florian Westphal (3): netfilter: nft_set_pipapo: store index in scratch maps netfilter: nft_set_pipapo: add helper to release pcpu scratch area netfilter: nft_set_pipapo: remove scratch_aligned pointer Pablo Neira Ayuso (1): netfilter: nft_set_pipapo: release elements in clone only from destroy path net/netfilter/nft_set_pipapo.c | 113 ++++++++++++++-------------- net/netfilter/nft_set_pipapo.h | 18 +++-- net/netfilter/nft_set_pipapo_avx2.c | 17 ++--- 3 files changed, 76 insertions(+), 72 deletions(-) -- 2.25.1

2 5

[PATCH OLK-5.10 0/4] cvm feature patches
by hejingxian 09 Apr '24

09 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches: 1. add cvm host feature 2. enable pmu phys irq inject for cvm 3. add bounce buffer feature for cvm guest 4. add lpi support for cvm guest arch/arm64/configs/defconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/include/asm/cvm_guest.h | 21 + arch/arm64/include/asm/kvm_emulate.h | 13 + arch/arm64/include/asm/kvm_host.h | 12 + arch/arm64/include/asm/kvm_tmi.h | 377 ++++++++++++ arch/arm64/include/asm/kvm_tmm.h | 72 +++ arch/arm64/kvm/Kconfig | 16 + arch/arm64/kvm/Makefile | 5 + arch/arm64/kvm/arch_timer.c | 104 +++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 805 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 223 +++++++ arch/arm64/kvm/cvm_guest.c | 91 +++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 17 +- arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 10 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 ++++++ arch/arm64/kvm/vgic/vgic-v3.c | 17 +- arch/arm64/kvm/vgic/vgic.c | 55 +- arch/arm64/mm/mmu.c | 11 + arch/arm64/mm/pageattr.c | 9 +- drivers/irqchip/irq-gic-v3-its.c | 228 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 21 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 13 + include/uapi/linux/kvm.h | 29 + kernel/dma/direct.c | 39 ++ kernel/dma/swiotlb.c | 86 ++- virt/kvm/kvm_main.c | 7 +- 36 files changed, 2646 insertions(+), 44 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/cvm_guest.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 5

[PATCH openEuler-22.03-LTS-SP2] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
by ZhaoLong Wang 09 Apr '24

09 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.8-rc3 commit 832698373a25950942c04a512daa652c18a9b513 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MF CVE: CVE-2024-26772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 929fc424d68a..4776c537da84 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1888,12 +1888,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1926,6 +1924,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); -- 2.39.2

2 1