- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP2] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
by ZhaoLong Wang 09 Apr '24

09 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.8-rc3 commit 832698373a25950942c04a512daa652c18a9b513 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MF CVE: CVE-2024-26772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 929fc424d68a..4776c537da84 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1888,12 +1888,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1926,6 +1924,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
by ZhaoLong Wang 09 Apr '24

09 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.8-rc3 commit 832698373a25950942c04a512daa652c18a9b513 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MF CVE: CVE-2024-26772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index fd8464aadf00..aa3668cda460 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1894,12 +1894,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1932,6 +1930,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
by ZhaoLong Wang 09 Apr '24

09 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.8-rc3 commit 832698373a25950942c04a512daa652c18a9b513 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MF CVE: CVE-2024-26772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 19108d6bb566..6ec1ef0447c8 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1894,12 +1894,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1932,6 +1930,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); -- 2.39.2

2 1

[PATCH OLK-5.10] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
by ZhaoLong Wang 09 Apr '24

09 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.8-rc3 commit 832698373a25950942c04a512daa652c18a9b513 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MF CVE: CVE-2024-26772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 2d33c0123b72..33483862dcb5 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1912,12 +1912,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1950,6 +1948,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
by ZhaoLong Wang 09 Apr '24

09 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.8-rc3 commit 832698373a25950942c04a512daa652c18a9b513 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MF CVE: CVE-2024-26772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index c07289164c12..4c52e74946ab 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1836,12 +1836,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1874,6 +1872,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/1] fixup CVE-2024-26751
by Yuntao Liu 09 Apr '24

09 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): [Backport] ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
by ZhaoLong Wang 09 Apr '24

09 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.8-rc3 commit 832698373a25950942c04a512daa652c18a9b513 category: bugfix bugzilla: 189763 CVE: CVE-2024-26772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index c07289164c12..4c52e74946ab 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1836,12 +1836,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1874,6 +1872,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2 0/4] CVE-2024-26771
by GUO Zihua 09 Apr '24

09 Apr '24

This patchset fixes CVE-2024-26771. Conflicts of patch 2 and 3 is cause by commit 31f4b28f6c41 ("dmaengine: ti: edma: Add support for handling reserved channels") not being merged, which has been adapted. Conflicts of patch 4 is a context conflict which does not effect the effectiveness of this patch. v2: Removed CVE dedication for the first 3 patches. Chuhong Yuan (2): dmaengine: ti: edma: fix missed failure handling dmaengine: ti: edma: add missed operations Kunwu Chan (1): dmaengine: ti: edma: Add some null pointer checks to the edma_probe Wei Yongjun (1): dmaengine: ti: edma: Fix error return code in edma_probe() drivers/dma/ti/edma.c | 53 +++++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 17 deletions(-) -- 2.34.1

2 5

[openeuler:OLK-5.10 9479/30000] mm/dynamic_hugetlb.c:198:55: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 09 Apr '24

09 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 03571c277d6443f7ba8712ac6c9073fa9fa0d3bf commit: a8a836a36072aacbc4aaf08b8b3c8a654dbc0157 [9479/30000] mm/dynamic_hugetlb: establish the dynamic hugetlb feature framework config: x86_64-randconfig-r132-20240409 (https://download.01.org/0day-ci/archive/20240409/202404091402.qUFwznOY-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240409/202404091402.qUFwznOY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404091402.qUFwznOY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/dynamic_hugetlb.c:198:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_hugetlb.c:198:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_hugetlb.c:198:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * vim +198 mm/dynamic_hugetlb.c 195 196 int hugetlb_pool_destroy(struct cgroup *cgrp) 197 { > 198 struct cgroup_subsys_state *css = cgrp->subsys[memory_cgrp_id]; 199 struct mem_cgroup *memcg = mem_cgroup_from_css(css); 200 struct dhugetlb_pool *hpool = memcg ? memcg->hpool : NULL; 201 int ret = 0; 202 203 if (!dhugetlb_enabled) 204 return 0; 205 206 if (!hpool || hpool->attach_memcg != memcg) 207 return 0; 208 209 ret = free_hugepage_to_hugetlb(hpool); 210 memcg->hpool = NULL; 211 212 put_hpool(hpool); 213 return ret; 214 } 215 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/4] CVE-2024-26771
by GUO Zihua 09 Apr '24

09 Apr '24

This patchset fixes CVE-2024-26771. Chuhong Yuan (2): dmaengine: ti: edma: fix missed failure handling dmaengine: ti: edma: add missed operations Kunwu Chan (1): dmaengine: ti: edma: Add some null pointer checks to the edma_probe Wei Yongjun (1): dmaengine: ti: edma: Fix error return code in edma_probe() drivers/dma/ti/edma.c | 53 +++++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 17 deletions(-) -- 2.34.1

2 5