- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] CVE-2023-52593
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Chen Ridong (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/staging/wfx/sta.c | 42 ++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] iommu/arm-smmu-v3: Disable ECMDQ before reset
by Wang Wensheng 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97CSY -------------------------------- In kdump kernel, the ECMDQ is enabled before and cannot be reset before it is disabled. This leads to "CMD_SYNC timeout" problem. Disable the ECMDQ before reset the ECMDQ to fix. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 3d3e0c935023..4b006590ae05 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3869,6 +3869,20 @@ static int arm_smmu_ecmdq_reset(struct arm_smmu_device *smmu) q->llq.prod = 0; q->llq.cons = 0; } + + reg = readl(q->prod_reg); + if (reg & ECMDQ_PROD_EN) { + /* disable ecmdq */ + writel(reg & ~ECMDQ_PROD_EN, q->prod_reg); + ret = readl_relaxed_poll_timeout(q->cons_reg, reg, + !(reg & ECMDQ_CONS_ENACK), 1, ARM_SMMU_POLL_TIMEOUT_US); + if (ret) { + dev_warn(smmu->dev, "ecmdq[%d] disable failed\n", i); + smmu->ecmdq_enabled = 0; + return ret; + } + } + writeq_relaxed(q->q_base, ecmdq->base + ARM_SMMU_ECMDQ_BASE); writel_relaxed(q->llq.prod, ecmdq->base + ARM_SMMU_ECMDQ_PROD); writel_relaxed(q->llq.cons, ecmdq->base + ARM_SMMU_ECMDQ_CONS); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS v2 0/3] jfs: fix two cve issue
by Long Li 19 Mar '24

19 Mar '24

This patch set fix two cve issue. Dongliang Mu (1): JFS: fix memleak in jfs_mount Edward Adam Davis (2): jfs: fix uaf in jfs_evict_inode jfs: fix array-index-out-of-bounds in diNewExt fs/jfs/jfs_imap.c | 3 +++ fs/jfs/jfs_mount.c | 57 ++++++++++++++++++++-------------------------- 2 files changed, 28 insertions(+), 32 deletions(-) -- 2.31.1

2 4

[PATCH openEuler-22.03-LTS-SP2 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 306 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 315 insertions(+), 310 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS-SP1 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 304 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 309 insertions(+), 308 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 304 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 10 files changed, 309 insertions(+), 304 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 306 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 315 insertions(+), 310 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10] s390/ptrace: handle setting of fpc register correctly
by Zheng Zucheng 19 Mar '24

19 Mar '24

From: Heiko Carstens <hca(a)linux.ibm.com> mainline inclusion from mainline-v6.8-rc1 commit 8b13601d19c541158a6e18b278c00ba69ae37829 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7Q CVE: CVE-2023-52598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ] If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl(). Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c index 3009bb527252..f381caddd905 100644 --- a/arch/s390/kernel/ptrace.c +++ b/arch/s390/kernel/ptrace.c @@ -411,6 +411,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if ((unsigned int) data != 0 || test_fp_ctl(data >> (BITS_PER_LONG - 32))) return -EINVAL; @@ -771,6 +772,7 @@ static int __poke_user_compat(struct task_struct *child, /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if (test_fp_ctl(tmp)) return -EINVAL; child->thread.fpu.fpc = data; @@ -1010,9 +1012,7 @@ static int s390_fpregs_set(struct task_struct *target, int rc = 0; freg_t fprs[__NUM_FPRS]; - if (target == current) - save_fpu_regs(); - + save_fpu_regs(); if (MACHINE_HAS_VX) convert_vx_to_fp(fprs, target->thread.fpu.vxrs); else -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] s390/ptrace: handle setting of fpc register correctly
by Zheng Zucheng 19 Mar '24

19 Mar '24

From: Heiko Carstens <hca(a)linux.ibm.com> mainline inclusion from mainline-v6.8-rc1 commit 8b13601d19c541158a6e18b278c00ba69ae37829 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7Q CVE: CVE-2023-52598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ] If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl(). Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c index cd3df5514552..05e93dd5f67e 100644 --- a/arch/s390/kernel/ptrace.c +++ b/arch/s390/kernel/ptrace.c @@ -389,6 +389,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if ((unsigned int) data != 0 || test_fp_ctl(data >> (BITS_PER_LONG - 32))) return -EINVAL; @@ -747,6 +748,7 @@ static int __poke_user_compat(struct task_struct *child, /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if (test_fp_ctl(tmp)) return -EINVAL; child->thread.fpu.fpc = data; @@ -977,9 +979,7 @@ static int s390_fpregs_set(struct task_struct *target, int rc = 0; freg_t fprs[__NUM_FPRS]; - if (target == current) - save_fpu_regs(); - + save_fpu_regs(); if (MACHINE_HAS_VX) convert_vx_to_fp(fprs, target->thread.fpu.vxrs); else -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 6/6] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 19 Mar '24

19 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0