- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] CVE-2024-53142
by Liao Chen 12 Dec '24

12 Dec '24

CVE-2024-53142 David Disseldorp (1): initramfs: avoid filename buffer overrun init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-53142
by Liao Chen 12 Dec '24

12 Dec '24

CVE-2024-53142 David Disseldorp (1): [Backport] initramfs: avoid filename buffer overrun init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 v2 0/2] xfs: revert fix patchs about attr inactive
by Long Li 12 Dec '24

12 Dec '24

This path set revert fix patchs about attr inactive. Long Li (2): Revert "xfs: atomic drop extent entries when inactiving attr" Revert "xfs: factor out __xfs_da3_node_read()" fs/xfs/libxfs/xfs_da_btree.c | 5 ++- fs/xfs/libxfs/xfs_da_btree.h | 15 ++------- fs/xfs/xfs_attr_inactive.c | 62 ++++++++++-------------------------- 3 files changed, 20 insertions(+), 62 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-53142
by Liao Chen 12 Dec '24

12 Dec '24

CVE-2024-53142 David Disseldorp (1): initramfs: avoid filename buffer overrun init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10] x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
by Heyuan Wang 12 Dec '24

12 Dec '24

From: Mario Limonciello <mario.limonciello(a)amd.com> mainline inclusion from mainline-v6.12 commit a5ca1dc46a6b610dd4627d8b633d6c84f9724ef0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB8IUH CVE: CVE-2024-53114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A number of Zen4 client SoCs advertise the ability to use virtualized VMLOAD/VMSAVE, but using these instructions is reported to be a cause of a random host reboot. These instructions aren't intended to be advertised on Zen4 client so clear the capability. Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Cc: stable(a)vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=219009 Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- arch/x86/kernel/cpu/amd.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index 688c9ca69852..7f9ad035220e 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1102,6 +1102,17 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) if (!cpu_has(c, X86_FEATURE_HYPERVISOR)) msr_set_bit(MSR_ZEN4_BP_CFG, MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT); + + /* + * These Zen4 SoCs advertise support for virtualized VMLOAD/VMSAVE + * in some BIOS versions but they can lead to random host reboots. + */ + switch (c->x86_model) { + case 0x18 ... 0x1f: + case 0x60 ... 0x7f: + clear_cpu_cap(c, X86_FEATURE_V_VMSAVE_VMLOAD); + break; + } } static void init_amd_zen5(struct cpuinfo_x86 *c) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] kabi: restrict the KABI fix to a specific architecture and dist
by Xie XiuQi 12 Dec '24

12 Dec '24

Some distributions need to maintain and fix KABI compatibility so that drivers do not need to be recompiled during kernel upgrades. Fixing KABI compatibility is a dangerous and hacking job. Developers need to know clearly what they are doing and the risks they may face. KABI fix actions are closely related to the processor architecture. Fixes may not be appropriate for all architectures. Improper fix may cause kernel panic or unexpected error. Only for expert users, and select N by default. Xie XiuQi (2): kabi: restrict the KABI fix to a specific architecture and dist kabi: enable KABI_COMPAT series by default on x86_64 & ARM64 arch/arm64/configs/openeuler_defconfig | 5 +-- arch/x86/configs/openeuler_defconfig | 5 +-- include/linux/kabi.h | 2 +- init/Kconfig | 50 +++++++++++++++++--------- 4 files changed, 41 insertions(+), 21 deletions(-) -- 2.20.1

2 3

[openeuler:openEuler-1.0-LTS 0/219] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 12 Dec '24

12 Dec '24

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: faa52e40c08916893e09ba030e616f92e4fc020b commit: 190aae97bcddbed131a203f829257b168f5058ce [0/219] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-buildonly-randconfig-003-20240112 (https://download.01.org/0day-ci/archive/20241212/202412120546.1VT9HCPP-lkp@…) compiler: ClangBuiltLinux clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241212/202412120546.1VT9HCPP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412120546.1VT9HCPP-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
by Heyuan Wang 11 Dec '24

11 Dec '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc6 commit bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AI CVE: CVE-2024-50218 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two reasons for this: first, the parameter value passed is greater than ocfs2_max_inline_data_with_xattr, second, the start and end parameters of ocfs2_truncate_inline are "unsigned int". So, we need to add a sanity check for byte_start and byte_len right before ocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater than ocfs2_max_inline_data_with_xattr return -EINVAL. Link: https://lkml.kernel.org/r/tencent_D48DB5122ADDAEDDD11918CFB68D93258C07@qq.c… Fixes: 1afc32b95233 ("ocfs2: Write support for inline data") Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+81092778aac03460d6b7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=81092778aac03460d6b7 Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/ocfs2/file.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index da209f81c9ee..135b7334be7d 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1790,6 +1790,14 @@ int ocfs2_remove_inode_range(struct inode *inode, return 0; if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { + int id_count = ocfs2_max_inline_data_with_xattr(inode->i_sb, di); + + if (byte_start > id_count || byte_start + byte_len > id_count) { + ret = -EINVAL; + mlog_errno(ret); + goto out; + } + ret = ocfs2_truncate_inline(inode, di_bh, byte_start, byte_start + byte_len, 0); if (ret) { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
by Heyuan Wang 11 Dec '24

11 Dec '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc6 commit bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AI CVE: CVE-2024-50218 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two reasons for this: first, the parameter value passed is greater than ocfs2_max_inline_data_with_xattr, second, the start and end parameters of ocfs2_truncate_inline are "unsigned int". So, we need to add a sanity check for byte_start and byte_len right before ocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater than ocfs2_max_inline_data_with_xattr return -EINVAL. Link: https://lkml.kernel.org/r/tencent_D48DB5122ADDAEDDD11918CFB68D93258C07@qq.c… Fixes: 1afc32b95233 ("ocfs2: Write support for inline data") Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+81092778aac03460d6b7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=81092778aac03460d6b7 Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/ocfs2/file.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index a12f35d15032..9f36b17feb1a 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1790,6 +1790,14 @@ int ocfs2_remove_inode_range(struct inode *inode, return 0; if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { + int id_count = ocfs2_max_inline_data_with_xattr(inode->i_sb, di); + + if (byte_start > id_count || byte_start + byte_len > id_count) { + ret = -EINVAL; + mlog_errno(ret); + goto out; + } + ret = ocfs2_truncate_inline(inode, di_bh, byte_start, byte_start + byte_len, 0); if (ret) { -- 2.25.1

2 1

[PATCH OLK-5.10] ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
by Heyuan Wang 11 Dec '24

11 Dec '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc6 commit bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AI CVE: CVE-2024-50218 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two reasons for this: first, the parameter value passed is greater than ocfs2_max_inline_data_with_xattr, second, the start and end parameters of ocfs2_truncate_inline are "unsigned int". So, we need to add a sanity check for byte_start and byte_len right before ocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater than ocfs2_max_inline_data_with_xattr return -EINVAL. Link: https://lkml.kernel.org/r/tencent_D48DB5122ADDAEDDD11918CFB68D93258C07@qq.c… Fixes: 1afc32b95233 ("ocfs2: Write support for inline data") Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+81092778aac03460d6b7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=81092778aac03460d6b7 Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/ocfs2/file.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 43ce41404e72..294fc98a900e 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1790,6 +1790,14 @@ int ocfs2_remove_inode_range(struct inode *inode, return 0; if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { + int id_count = ocfs2_max_inline_data_with_xattr(inode->i_sb, di); + + if (byte_start > id_count || byte_start + byte_len > id_count) { + ret = -EINVAL; + mlog_errno(ret); + goto out; + } + ret = ocfs2_truncate_inline(inode, di_bh, byte_start, byte_start + byte_len, 0); if (ret) { -- 2.25.1

2 1