- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS 0/1] CVE-2023-52655
by Yongqiang Liu 21 May '24

21 May '24

Oliver Neukum (1): usb: aqc111: check packet for fixup for true limit drivers/net/usb/aqc111.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 00/33] Port livepatch related patches
by Zheng Yejian 21 May '24

21 May '24

Link: https://gitee.com/openeuler/kernel/issues/I9R2TB Masami Hiramatsu (3): x86/unwind: Recover kretprobe trampoline entry x86/unwind: Compile kretprobe fixup code only if CONFIG_KRETPROBES=y arm64: Recover kretprobe modified return address in stacktrace Zheng Yejian (30): livepatch: Move 'struct klp_func_list' out of arch livepatch/x86: Move 'struct klp_func_list' related codes out of arch livepatch/arm: Remove duplicate 'struct klp_func_list' related codes livepatch/arm64: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc32: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc64: Remove duplicate 'struct klp_func_list' related codes livepatch/x86: Implement arch_klp_check_task_calltrace() livepatch/arm: Implement arch_klp_check_task_calltrace() livepatch/arm64: Implement arch_klp_check_task_calltrace() livepatch/ppc32: Implement arch_klp_check_task_calltrace() livepatch/ppc64: Implement arch_klp_check_task_calltrace() livepatch/x86: Ajust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc32: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/core: No stop machine in KLP_STACK_OPTIMIZE mode livepatch: Complete check calltrace for running tasks livepatch: Check calltrace of idle tasks livepatch: Organize active functions with struct 'list_head' [Huawei] livepatch: Fix huge_depth in arch_klp_check_activeness_func() livepatch: Use func->func_node directly livepatch/core: Make several functions to be static livepatch: Fix warning C_RULE_ID_SINGLE_BRANCH_IF_AND_LOOP_BRACKET livepatch: Reduce duplicate definition of 'struct walk_stackframe_args' ftrace: Fix possible use-after-free issue in ftrace_location() kprobes: Fix possible use-after-free issue on kprobe registration livepatch: Avoid patching conflicts with kprobes kprobes: Add kretprobe_find_ret_addr() for searching return address livepatch: Enable CONFIG_LIVEPATCH_ISOLATE_KPROBE in openeuler_defconfig arch/arm/include/asm/livepatch.h | 6 - arch/arm/kernel/livepatch.c | 334 +++++------------ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/livepatch.h | 4 - arch/arm64/kernel/livepatch.c | 360 ++++++------------- arch/arm64/kernel/stacktrace.c | 4 + arch/powerpc/include/asm/livepatch.h | 6 +- arch/powerpc/kernel/livepatch.c | 22 ++ arch/powerpc/kernel/livepatch_32.c | 367 +++++-------------- arch/powerpc/kernel/livepatch_64.c | 435 ++++++++++------------- arch/powerpc/kernel/module_64.c | 29 +- arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/livepatch.h | 5 - arch/x86/include/asm/unwind.h | 26 ++ arch/x86/kernel/livepatch.c | 320 ++++------------- arch/x86/kernel/unwind_frame.c | 3 +- arch/x86/kernel/unwind_guess.c | 3 +- arch/x86/kernel/unwind_orc.c | 21 +- include/linux/kprobes.h | 24 ++ include/linux/livepatch.h | 30 +- kernel/kprobes.c | 66 +++- kernel/livepatch/Kconfig | 25 ++ kernel/livepatch/core.c | 473 ++++++++++++++++++++++++- kernel/trace/ftrace.c | 39 +- 24 files changed, 1243 insertions(+), 1361 deletions(-) -- 2.25.1

2 34

[PATCH v3 OLK-5.10 00/11] sync hulk-5.10 patches
by Yu Kuai 21 May '24

21 May '24

Changes in v3: - modify openeuler_defconfig for disabled new config Changes in v2: - fix head in commit message Three features related: - add a switch to enable hungtask check for io, patch 1-2 - add a config to control hierarchical throttle, patch 3-4 - support enable/disable blk-mq debugfs dynamically, patch 5-11 Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (9): block: add a switch to enable hungtask check for io block: disable BLK_IO_HUNG_TASK_CHECK by default blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue block: support to disable debugfs by default arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 31 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 87 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 12 ++++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 ++++++++++++++++++---- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 8 ++- kernel/trace/blktrace.c | 3 - 18 files changed, 249 insertions(+), 42 deletions(-) -- 2.39.2

2 12

[PATCH OLK-5.10 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[openeuler:openEuler-1.0-LTS 21291/22450] drivers/spi/spi-phytium-plat.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 May '24

21 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5708160127a606e51a136509cfe0a9448a09849a commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [21291/22450] spi: add phytium spi support config: x86_64-buildonly-randconfig-004-20240521 (https://download.01.org/0day-ci/archive/20240521/202405211804.T84TVKIc-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240521/202405211804.T84TVKIc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405211804.T84TVKIc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/spi/spi-phytium-plat.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP2] bpf: Guard stack limits against 32bit overflow
by Pu Lehui 21 May '24

21 May '24

From: Andrei Matei <andreimatei1(a)gmail.com> mainline inclusion from mainline-v6.8-rc1 commit 1d38a9ee81570c4bd61f557832dead4d6f816760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EW CVE: CVE-2023-52676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… Reported-by: Andrii Nakryiko <andrii.nakryiko(a)gmail.com> Signed-off-by: Andrei Matei <andreimatei1(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com Conflicts: kernel/bpf/verifier.c [The conflict is because some modifications were merged by the commit 8f5863d230fed ("bpf: Fix accesses to uninit stack slots")] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c781e753e9a9..b74fd334a2ca 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3770,7 +3770,7 @@ static int check_stack_access_within_bounds( struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; struct bpf_func_state *state = func(env, reg); - int min_off, max_off; + s64 min_off, max_off; int err; char *err_extra; @@ -3783,7 +3783,7 @@ static int check_stack_access_within_bounds( err_extra = " write to"; if (tnum_is_const(reg->var_off)) { - min_off = reg->var_off.value + off; + min_off = (s64)reg->var_off.value + off; max_off = min_off + access_size; } else { if (reg->smax_value >= BPF_MAX_VAR_OFF || -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Guard stack limits against 32bit overflow
by Pu Lehui 21 May '24

21 May '24

From: Andrei Matei <andreimatei1(a)gmail.com> mainline inclusion from mainline-v6.8-rc1 commit 1d38a9ee81570c4bd61f557832dead4d6f816760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EW CVE: CVE-2023-52676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… Reported-by: Andrii Nakryiko <andrii.nakryiko(a)gmail.com> Signed-off-by: Andrei Matei <andreimatei1(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com Conflicts: kernel/bpf/verifier.c [The conflict is because some modifications were merged by the commit db2a27bb5398e ("bpf: Fix accesses to uninit stack slots")] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d5706782be14..946e485a102c 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3697,7 +3697,7 @@ static int check_stack_access_within_bounds( struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; struct bpf_func_state *state = func(env, reg); - int min_off, max_off; + s64 min_off, max_off; int err; char *err_extra; @@ -3710,7 +3710,7 @@ static int check_stack_access_within_bounds( err_extra = " write to"; if (tnum_is_const(reg->var_off)) { - min_off = reg->var_off.value + off; + min_off = (s64)reg->var_off.value + off; max_off = min_off + access_size; } else { if (reg->smax_value >= BPF_MAX_VAR_OFF || -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] bpf: Guard stack limits against 32bit overflow
by Pu Lehui 21 May '24

21 May '24

From: Andrei Matei <andreimatei1(a)gmail.com> mainline inclusion from mainline-v6.8-rc1 commit 1d38a9ee81570c4bd61f557832dead4d6f816760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EW CVE: CVE-2023-52676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… Reported-by: Andrii Nakryiko <andrii.nakryiko(a)gmail.com> Signed-off-by: Andrei Matei <andreimatei1(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com Conflicts: kernel/bpf/verifier.c [The conflict is because some modifications were merged by the commit f18a791ef88ed ("bpf: Fix accesses to uninit stack slots")] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1b7e855962b8..222aa218f826 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3696,7 +3696,7 @@ static int check_stack_access_within_bounds( struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; struct bpf_func_state *state = func(env, reg); - int min_off, max_off; + s64 min_off, max_off; int err; char *err_extra; @@ -3709,7 +3709,7 @@ static int check_stack_access_within_bounds( err_extra = " write to"; if (tnum_is_const(reg->var_off)) { - min_off = reg->var_off.value + off; + min_off = (s64)reg->var_off.value + off; max_off = min_off + access_size; } else { if (reg->smax_value >= BPF_MAX_VAR_OFF || -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
by Cheng Yu 21 May '24

21 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.9-rc1 commit 5d7f58ee08434a33340f75ac7ac5071eea9673b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGK5 CVE: CVE-2024-35943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Link: https://lore.kernel.org/r/20240118054257.200814-1-chentao@kylinos.cn Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Conflicts: drivers/soc/ti/omap_prm.c drivers/pmdomain/ti/omap_prm.c [This is a conflict caused by commit e2ad626f8f40("pmdomain: Rename the genpd subsystem to pmdomain") which is not merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/soc/ti/omap_prm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c index 4a782bfd753c..2ce8a8f4f005 100644 --- a/drivers/soc/ti/omap_prm.c +++ b/drivers/soc/ti/omap_prm.c @@ -381,6 +381,8 @@ static int omap_prm_domain_init(struct device *dev, struct omap_prm *prm) data = prm->data; name = devm_kasprintf(dev, GFP_KERNEL, "prm_%s", data->name); + if (!name) + return -ENOMEM; prmd->dev = dev; prmd->prm = prm; -- 2.25.1

2 1