- Kernel - mailweb.openeuler.org

Re: [Dev] openEuler kernel sig meeting
by gwei3 19 Feb '21

19 Feb '21

申报议题： 2. 讨论设立sig安全联络员及如何缩短sig所属项目的CVE响应时间魏刚 ---Original--- From: "openEuler conference"<public(a)openeuler.io> Date: Thu, Feb 18, 2021 17:12 PM To: "dev"<dev(a)openeuler.org>;"kernel"<kernel(a)openeuler.org>; Subject: [Dev] openEuler kernel sig meeting 您好！ openEuler Kernel SIG 邀请您参加 2021-02-19 10:00 召开的ZOOM会议会议主题：openEuler kernel sig meeting 会议内容：1. 树莓派补丁合入openEuler 5.10 内核讨论会议链接：https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference will be held at 2021-02-19 10:00, The subject of the conference is openEuler kernel sig meeting, Summary: 1. 树莓派补丁合入openEuler 5.10 内核讨论 You can join the meeting at https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09. More information

1 0

[PATCH kernel-4.19 00/18] backport stable-4.19-174
by Yang Yingliang 09 Feb '21

09 Feb '21

Arnold Gozum (1): platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron 7352 Brian King (1): scsi: ibmvfc: Set default timeout to avoid crash during migration Christian Brauner (1): sysctl: handle overflow in proc_get_long Eric Dumazet (1): net_sched: gen_estimator: support large ewma log Felix Fietkau (1): mac80211: fix fast-rx encryption check Greg Kroah-Hartman (1): Linux 4.19.174 Hans de Goede (1): platform/x86: touchscreen_dmi: Add swap-x-y quirk for Goodix touchscreen on Estar Beauty HD tablet Javed Hasan (1): scsi: libfc: Avoid invoking response handler twice if ep is already completed Josh Poimboeuf (1): objtool: Don't fail on missing symbol table Lijun Pan (1): ibmvnic: Ensure that CRQ entry read are correctly ordered Martin Wilck (1): scsi: scsi_transport_srp: Don't block target in failfast state Michael Ellerman (1): selftests/powerpc: Only test lwm/stmw on big endian Pan Bian (1): net: dsa: bcm_sf2: put device node before return Peter Zijlstra (3): x86: __always_inline __{rd,wr}msr() kthread: Extract KTHREAD_IS_PER_CPU workqueue: Restrict affinity change to rescuer Rafael J. Wysocki (1): ACPI: thermal: Do not call acpi_thermal_check() directly Tony Lindgren (1): phy: cpcap-usb: Fix warning for missing regulator_disable Makefile | 2 +- arch/x86/include/asm/msr.h | 4 +- drivers/acpi/thermal.c | 55 +++++++++++++------ drivers/net/dsa/bcm_sf2.c | 8 ++- drivers/net/ethernet/ibm/ibmvnic.c | 6 ++ drivers/phy/motorola/phy-cpcap-usb.c | 19 +++++-- drivers/platform/x86/intel-vbtn.c | 6 ++ drivers/platform/x86/touchscreen_dmi.c | 18 ++++++ drivers/scsi/ibmvscsi/ibmvfc.c | 4 +- drivers/scsi/libfc/fc_exch.c | 16 +++++- drivers/scsi/scsi_transport_srp.c | 9 ++- include/linux/kthread.h | 3 + kernel/kthread.c | 27 ++++++++- kernel/smpboot.c | 1 + kernel/sysctl.c | 2 + kernel/workqueue.c | 9 +-- net/core/gen_estimator.c | 11 ++-- net/mac80211/rx.c | 2 + tools/objtool/elf.c | 7 ++- .../powerpc/alignment/alignment_handler.c | 5 +- 20 files changed, 168 insertions(+), 46 deletions(-) -- 2.25.1

1 18

[PATCH kernel-4.19 1/3] mmap: fix a compiling error for 'MAP_CHECKNODE'
by Yang Yingliang 09 Feb '21

09 Feb '21

From: Bixuan Cui <cuibixuan(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA MAP_CHECKNODE was defined in uapi/asm-generic/mman.h, that was not automatically included by mm/mmap.c when building on platforms such as mips, and result in following compiling error: mm/mmap.c: In function ‘__do_mmap’: mm/mmap.c:1581:14: error: ‘MAP_CHECKNODE’ undeclared (first use in this function) if (flags & MAP_CHECKNODE) ^ mm/mmap.c:1581:14: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:303: recipe for target 'mm/mmap.o' failed Fixes: 56a22a261008 ("arm64/ascend: mm: Add MAP_CHECKNODE flag to check node hugetlb") Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/alpha/include/uapi/asm/mman.h | 1 + arch/mips/include/uapi/asm/mman.h | 1 + arch/parisc/include/uapi/asm/mman.h | 1 + arch/powerpc/include/uapi/asm/mman.h | 1 + arch/sparc/include/uapi/asm/mman.h | 1 + arch/xtensa/include/uapi/asm/mman.h | 1 + 6 files changed, 6 insertions(+) diff --git a/arch/alpha/include/uapi/asm/mman.h b/arch/alpha/include/uapi/asm/mman.h index b3acfc00c8ec5..1c7ce2716ad37 100644 --- a/arch/alpha/include/uapi/asm/mman.h +++ b/arch/alpha/include/uapi/asm/mman.h @@ -34,6 +34,7 @@ #define MAP_HUGETLB 0x100000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x200000/* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_ASYNC 1 /* sync memory asynchronously */ #define MS_SYNC 2 /* synchronous memory sync */ diff --git a/arch/mips/include/uapi/asm/mman.h b/arch/mips/include/uapi/asm/mman.h index 72a00c746e781..4570a54ac1d90 100644 --- a/arch/mips/include/uapi/asm/mman.h +++ b/arch/mips/include/uapi/asm/mman.h @@ -52,6 +52,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* * Flags for msync diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h index 9e989d649e854..06857eb1bee8f 100644 --- a/arch/parisc/include/uapi/asm/mman.h +++ b/arch/parisc/include/uapi/asm/mman.h @@ -28,6 +28,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_SYNC 1 /* synchronous memory sync */ #define MS_ASYNC 2 /* sync memory asynchronously */ diff --git a/arch/powerpc/include/uapi/asm/mman.h b/arch/powerpc/include/uapi/asm/mman.h index 95f884ada96f1..24354f792b00d 100644 --- a/arch/powerpc/include/uapi/asm/mman.h +++ b/arch/powerpc/include/uapi/asm/mman.h @@ -30,6 +30,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* Override any generic PKEY permission defines */ #define PKEY_DISABLE_EXECUTE 0x4 diff --git a/arch/sparc/include/uapi/asm/mman.h b/arch/sparc/include/uapi/asm/mman.h index 0d1881b8f30d1..214abe17f44a0 100644 --- a/arch/sparc/include/uapi/asm/mman.h +++ b/arch/sparc/include/uapi/asm/mman.h @@ -27,6 +27,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #endif /* _UAPI__SPARC_MMAN_H__ */ diff --git a/arch/xtensa/include/uapi/asm/mman.h b/arch/xtensa/include/uapi/asm/mman.h index f584a590bb001..2c9d705602382 100644 --- a/arch/xtensa/include/uapi/asm/mman.h +++ b/arch/xtensa/include/uapi/asm/mman.h @@ -59,6 +59,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED # define MAP_UNINITIALIZED 0x4000000 /* For anonymous mmap, memory could be * uninitialized */ -- 2.25.1

1 2

[PATCH kernel-4.19 00/38] backport stable-4.19.173
by Yang Yingliang 09 Feb '21

09 Feb '21

Andrea Righi (1): leds: trigger: fix potential deadlock with libata Baoquan He (1): kernel: kexec: remove the lock operation of system_transition_mutex Bartosz Golaszewski (1): iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built Claudiu Beznea (1): drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] Dan Carpenter (1): can: dev: prevent potential information leak in can_fill_info() David Woodhouse (2): xen: Fix XenStore initialisation for XS_LOCAL iommu/vt-d: Gracefully handle DMAR units with no supported address widths Eyal Birger (1): xfrm: fix disable_xfrm sysctl when used on xfrm interfaces Giacinto Cifelli (1): net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family Greg Kroah-Hartman (1): Linux 4.19.173 Ivan Vecera (1): team: protect features update by RCU to avoid deadlock Jay Zhou (1): KVM: x86: get smi pending status correctly Johannes Berg (4): wext: fix NULL-ptr-dereference with cfg80211's lack of commit() iwlwifi: pcie: use jiffies for memory read spin time limit iwlwifi: pcie: reschedule in long-running memory reads mac80211: pause TX while changing interface type Josef Bacik (1): nbd: freeze the queue while we're adding connections Kai-Heng Feng (1): ACPI: sysfs: Prefer "compatible" modalias Kamal Heib (1): RDMA/cxgb4: Fix the reported max_recv_sge value Koen Vandeputte (1): ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming Laurent Badel (1): PM: hibernate: flush swap writer after marking Like Xu (1): KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] Lorenzo Bianconi (2): mt7601u: fix kernel crash unplugging the device mt7601u: fix rx buffer refcounting Max Krummenacher (1): ARM: imx: build suspend-imx6.S with arm instruction set Pablo Neira Ayuso (1): netfilter: nft_dynset: add timeout extension to template Pan Bian (2): NFC: fix resource leak when target index is invalid NFC: fix possible resource leak Pengcheng Yang (1): tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN Roger Pau Monne (2): xen/privcmd: allow fetching resource sizes xen-blkfront: allow discard-* nodes to be optional Roi Dayan (1): net/mlx5: Fix memory leak on flow table creation error flow Sean Young (1): media: rc: ensure that uevent can be read directly after rc device register Shmulik Ladkani (1): xfrm: Fix oops in xfrm_replay_advance_bmp Sudeep Holla (1): drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs Takashi Iwai (1): ALSA: hda/via: Apply the workaround generically for Clevo machines Takeshi Misawa (1): rxrpc: Fix memory leak in rxrpc_lookup_local Trond Myklebust (1): pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() Makefile | 2 +- arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +- arch/arm/mach-imx/suspend-imx6.S | 1 + arch/x86/kvm/pmu_intel.c | 2 +- arch/x86/kvm/x86.c | 5 +++ drivers/acpi/device_sysfs.c | 20 +++------ drivers/block/nbd.c | 8 ++++ drivers/block/xen-blkfront.c | 20 +++------ drivers/infiniband/hw/cxgb4/qp.c | 2 +- drivers/iommu/dmar.c | 45 +++++++++++++------ drivers/leds/led-triggers.c | 10 +++-- drivers/media/rc/rc-main.c | 4 +- drivers/net/can/dev.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + drivers/net/team/team.c | 6 +-- drivers/net/usb/qmi_wwan.c | 1 + .../net/wireless/intel/iwlwifi/pcie/trans.c | 14 +++--- drivers/net/wireless/mediatek/mt7601u/dma.c | 5 +-- drivers/soc/atmel/soc.c | 13 ++++++ drivers/xen/privcmd.c | 25 ++++++++--- drivers/xen/xenbus/xenbus_probe.c | 31 +++++++++++++ fs/nfs/pnfs.c | 1 + include/linux/intel-iommu.h | 2 + include/net/tcp.h | 2 +- kernel/kexec_core.c | 2 - kernel/power/swap.c | 2 +- net/ipv4/tcp_input.c | 10 +++-- net/ipv4/tcp_recovery.c | 5 ++- net/mac80211/ieee80211_i.h | 1 + net/mac80211/iface.c | 6 +++ net/netfilter/nft_dynset.c | 4 +- net/nfc/netlink.c | 1 + net/nfc/rawsock.c | 2 +- net/rxrpc/call_accept.c | 1 + net/wireless/wext-core.c | 5 ++- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 4 +- sound/pci/hda/patch_via.c | 2 +- 38 files changed, 183 insertions(+), 88 deletions(-) -- 2.25.1

1 38

[PATCH openEuler-1.0-LTS 1/2] nbd: Fix memory leak in nbd_add_socket
by Yang Yingliang 07 Feb '21

07 Feb '21

From: Zheng Bin <zhengbin13(a)huawei.com> stable inclusion from linux-4.19.133 commit 306290bad932950adccfbf99c27b70c105c2c183 -------------------------------- [ Upstream commit 579dd91ab3a5446b148e7f179b6596b270dace46 ] When adding first socket to nbd, if nsock's allocation failed, the data structure member "config->socks" was reallocated, but the data structure member "config->num_connections" was not updated. A memory leak will occur then because the function "nbd_config_put" will free "config->socks" only when "config->num_connections" is not zero. Fixes: 03bf73c315ed ("nbd: prevent memory leak") Reported-by: syzbot+934037347002901b8d2a(a)syzkaller.appspotmail.com Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 49f98b9b2777..97fcb040056c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -993,25 +993,26 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, test_bit(NBD_RT_BOUND, &config->runtime_flags))) { dev_err(disk_to_dev(nbd->disk), "Device being setup by another task"); - sockfd_put(sock); - return -EBUSY; + err = -EBUSY; + goto put_socket; + } + + nsock = kzalloc(sizeof(*nsock), GFP_KERNEL); + if (!nsock) { + err = -ENOMEM; + goto put_socket; } socks = krealloc(config->socks, (config->num_connections + 1) * sizeof(struct nbd_sock *), GFP_KERNEL); if (!socks) { - sockfd_put(sock); - return -ENOMEM; + kfree(nsock); + err = -ENOMEM; + goto put_socket; } config->socks = socks; - nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); - if (!nsock) { - sockfd_put(sock); - return -ENOMEM; - } - nsock->fallback_index = -1; nsock->dead = false; mutex_init(&nsock->tx_lock); @@ -1023,6 +1024,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, atomic_inc(&config->live_connections); return 0; + +put_socket: + sockfd_put(sock); + return err; } static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/7] futex: Ensure the correct return value from futex_lock_pi()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from linux-4.19.172 commit 72f38fffa4758b878f819f8a47761b3f03443f36 CVE: CVE-2021-3347 -------------------------------- commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream In case that futex_lock_pi() was aborted by a signal or a timeout and the task returned without acquiring the rtmutex, but is the designated owner of the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to establish consistent state. In that case it invokes fixup_pi_state_owner() which in turn tries to acquire the rtmutex again. If that succeeds then it does not propagate this success to fixup_owner() and futex_lock_pi() returns -EINTR or -ETIMEOUT despite having the futex locked. Return success from fixup_pi_state_owner() in all cases where the current task owns the rtmutex and therefore the futex and propagate it correctly through fixup_owner(). Fixup the other callsite which does not expect a positive return value. Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/futex.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index 28b321e23053..ca9389bd110f 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -2414,8 +2414,8 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, } if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) { - /* We got the lock after all, nothing to fix. */ - ret = 0; + /* We got the lock. pi_state is correct. Tell caller. */ + ret = 1; goto out_unlock; } @@ -2431,7 +2431,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * We raced against a concurrent self; things are * already fixed up. Nothing to do. */ - ret = 0; + ret = 1; goto out_unlock; } newowner = argowner; @@ -2477,7 +2477,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, raw_spin_unlock(&newowner->pi_lock); raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); - return 0; + return argowner == current; /* * In order to reschedule or handle a page fault, we need to drop the @@ -2519,7 +2519,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * Check if someone else fixed it for us: */ if (pi_state->owner != oldowner) { - ret = 0; + ret = argowner == current; goto out_unlock; } @@ -2552,8 +2552,6 @@ static long futex_wait_restart(struct restart_block *restart); */ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) { - int ret = 0; - if (locked) { /* * Got the lock. We might not be the anticipated owner if we @@ -2564,8 +2562,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * stable state, anything else needs more attention. */ if (q->pi_state->owner != current) - ret = fixup_pi_state_owner(uaddr, q, current); - goto out; + return fixup_pi_state_owner(uaddr, q, current); + return 1; } /* @@ -2576,10 +2574,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * Another speculative read; pi_state->owner == current is unstable * but needs our attention. */ - if (q->pi_state->owner == current) { - ret = fixup_pi_state_owner(uaddr, q, NULL); - goto out; - } + if (q->pi_state->owner == current) + return fixup_pi_state_owner(uaddr, q, NULL); /* * Paranoia check. If we did not take the lock, then we should not be @@ -2592,8 +2588,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) q->pi_state->owner); } -out: - return ret ? ret : locked; + return 0; } /** @@ -3315,7 +3310,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, if (q.pi_state && (q.pi_state->owner != current)) { spin_lock(q.lock_ptr); ret = fixup_pi_state_owner(uaddr2, &q, current); - if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { + if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { pi_state = q.pi_state; get_pi_state(pi_state); } @@ -3325,6 +3320,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, */ put_pi_state(q.pi_state); spin_unlock(q.lock_ptr); + /* + * Adjust the return value. It's either -EFAULT or + * success (1) but the caller expects 0 for success. + */ + ret = ret < 0 ? ret : 0; } } else { struct rt_mutex *pi_mutex; -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 1/3] netfilter: clear skb->next in NF_HOOK_LIST()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Cong Wang <cong.wang(a)bytedance.com> stable inclusion from linux-4.19.161 commit 5460d62d661c0fc53bfe83493821b1dc3dc969f4 -------------------------------- NF_HOOK_LIST() uses list_del() to remove skb from the linked list, however, it is not sufficient as skb->next still points to other skb. We should just call skb_list_del_init() to clear skb->next, like the rest places which using skb list. This has been fixed in upstream by commit ca58fbe06c54 ("netfilter: add and use nf_hook_slow_list()"). Fixes: 9f17dbf04ddf ("netfilter: fix use-after-free in NF_HOOK_LIST") Reported-by: liuzx(a)knownsec.com Tested-by: liuzx(a)knownsec.com Cc: Florian Westphal <fw(a)strlen.de> Cc: Edward Cree <ecree(a)solarflare.com> Cc: stable(a)vger.kernel.org # between 4.19 and 5.4 Signed-off-by: Cong Wang <cong.wang(a)bytedance.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/netfilter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 72cb19c3db6a..9460a5635c90 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -300,7 +300,7 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, INIT_LIST_HEAD(&sublist); list_for_each_entry_safe(skb, next, head, list) { - list_del(&skb->list); + skb_list_del_init(skb); if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) list_add_tail(&skb->list, &sublist); } -- 2.25.1

1 2

[PATCH kernel-4.19 1/4] arm64: module: rework special section handling
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.5-rc1 commit bd8b21d3dd661658addc1cd4cc869bab11d28596 category: bugfix bugzilla: 25285 CVE: NA -------------------------------- When we load a module, we have to perform some special work for a couple of named sections. To do this, we iterate over all of the module's sections, and perform work for each section we recognize. To make it easier to handle the unexpected absence of a section, and to make the section-specific logic easer to read, let's factor the section search into a helper. Similar is already done in the core module loader, and other architectures (and ideally we'd unify these in future). If we expect a module to have an ftrace trampoline section, but it doesn't have one, we'll now reject loading the module. When ARM64_MODULE_PLTS is selected, any correctly built module should have one (and this is assumed by arm64's ftrace PLT code) and the absence of such a section implies something has gone wrong at build time. Subsequent patches will make use of the new helper. Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Reviewed-by: Torsten Duwe <duwe(a)suse.de> Tested-by: Amit Daniel Kachhap <amit.kachhap(a)arm.com> Tested-by: Torsten Duwe <duwe(a)suse.de> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/module.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c index 834ecf108b53..55b00bfb704f 100644 --- a/arch/arm64/kernel/module.c +++ b/arch/arm64/kernel/module.c @@ -484,22 +484,39 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, return -ENOEXEC; } -int module_finalize(const Elf_Ehdr *hdr, - const Elf_Shdr *sechdrs, - struct module *me) +static const Elf_Shdr *find_section(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + const char *name) { const Elf_Shdr *s, *se; const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) { - if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) - apply_alternatives_module((void *)s->sh_addr, s->sh_size); + if (strcmp(name, secstrs + s->sh_name) == 0) + return s; + } + + return NULL; +} + +int module_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + struct module *me) +{ + const Elf_Shdr *s; + + s = find_section(hdr, sechdrs, ".altinstructions"); + if (s) + apply_alternatives_module((void *)s->sh_addr, s->sh_size); + #ifdef CONFIG_ARM64_MODULE_PLTS - if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) && - !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name)) - me->arch.ftrace_trampoline = (void *)s->sh_addr; -#endif + if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE)) { + s = find_section(hdr, sechdrs, ".text.ftrace_trampoline"); + if (!s) + return -ENOEXEC; + me->arch.ftrace_trampoline = (void *)s->sh_addr; } +#endif return 0; } -- 2.25.1

1 3

[PATCH kernel-4.19 00/27] backport stable-4.19.172
by Yang Yingliang 04 Feb '21

04 Feb '21

Baruch Siach (1): gpio: mvebu: fix pwm .get_state period calculation Eric Biggers (1): fs: fix lazytime expiration handling in __writeback_single_inode() Gaurav Kohli (1): tracing: Fix race in trace_open and buffer resize call Greg Kroah-Hartman (1): Linux 4.19.172 Jan Kara (1): writeback: Drop I_DIRTY_TIME_EXPIRE Jason Gerecke (1): HID: wacom: Correct NULL dereference on AES pen proximity Jean-Philippe Brucker (1): tools: Factor HOSTCC, HOSTLD, HOSTAR definitions Mikulas Patocka (1): dm integrity: conditionally disable "recalculate" feature Thomas Gleixner (18): futex: Move futex exit handling into futex code futex: Replace PF_EXITPIDONE with a state exit/exec: Seperate mm_release() futex: Split futex_mm_release() for exit/exec futex: Set task::futex_state to DEAD right after handling futex exit futex: Mark the begin of futex exit explicitly futex: Sanitize exit state handling futex: Provide state handling for exec() as well futex: Add mutex around futex exit futex: Provide distinct return value when owner is exiting futex: Prevent exit livelock futex: Ensure the correct return value from futex_lock_pi() futex: Replace pointless printk in fixup_owner() futex: Provide and use pi_state_update_owner() rtmutex: Remove unused argument from rt_mutex_proxy_unlock() futex: Use pi_state_update_owner() in put_pi_state() futex: Simplify fixup_pi_state_owner() futex: Handle faults correctly for PI futexes Wang Hai (1): Revert "mm/slub: fix a memory leak in sysfs_slab_add()" Documentation/device-mapper/dm-integrity.txt | 7 + Makefile | 2 +- drivers/gpio/gpio-mvebu.c | 25 +- drivers/hid/wacom_sys.c | 7 +- drivers/hid/wacom_wac.h | 2 +- drivers/md/dm-integrity.c | 24 +- fs/exec.c | 2 +- fs/ext4/inode.c | 2 +- fs/fs-writeback.c | 36 +- fs/xfs/xfs_trans_inode.c | 4 +- include/linux/compat.h | 2 - include/linux/fs.h | 1 - include/linux/futex.h | 40 +- include/linux/sched.h | 3 +- include/linux/sched/mm.h | 6 +- include/trace/events/writeback.h | 1 - kernel/exit.c | 30 +- kernel/fork.c | 40 +- kernel/futex.c | 485 +++++++++++++------ kernel/locking/rtmutex.c | 3 +- kernel/locking/rtmutex_common.h | 3 +- kernel/trace/ring_buffer.c | 4 + mm/slub.c | 4 +- tools/build/Makefile | 4 - tools/objtool/Makefile | 9 - tools/perf/Makefile.perf | 4 - tools/power/acpi/Makefile.config | 1 - tools/scripts/Makefile.include | 10 + 28 files changed, 459 insertions(+), 302 deletions(-) -- 2.25.1

1 27

[PATCH kernel-4.19 1/2] netfilter: add and use nf_hook_slow_list()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v5.5-rc1 commit ca58fbe06c54795f00db79e447f94c2028d30124 category: bugfix bugzilla: NA CVE: CVE-2021-20177 -------------------------------- At this time, NF_HOOK_LIST() macro will iterate the list and then calls nf_hook() for each individual skb. This makes it so the entire list is passed into the netfilter core. The advantage is that we only need to fetch the rule blob once per list instead of per-skb. NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only callers. v2: use skb_list_del_init() instead of list_del (Edward Cree) Signed-off-by: Florian Westphal <fw(a)strlen.de> Acked-by: Edward Cree <ecree(a)solarflare.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/linux/netfilter.h net/netfilter/core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/netfilter.h | 41 +++++++++++++++++++++++++++++---------- net/netfilter/core.c | 20 +++++++++++++++++++ 2 files changed, 51 insertions(+), 10 deletions(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 9460a5635c90..8bf57abee9e4 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -183,6 +183,8 @@ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, const struct nf_hook_entries *e, unsigned int i); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e); /** * nf_hook - call a netfilter hook * @@ -295,17 +297,36 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct list_head *head, struct net_device *in, struct net_device *out, int (*okfn)(struct net *, struct sock *, struct sk_buff *)) { - struct sk_buff *skb, *next; - struct list_head sublist; - - INIT_LIST_HEAD(&sublist); - list_for_each_entry_safe(skb, next, head, list) { - skb_list_del_init(skb); - if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) - list_add_tail(&skb->list, &sublist); + struct nf_hook_entries *hook_head = NULL; + +#ifdef CONFIG_JUMP_LABEL + if (__builtin_constant_p(pf) && + __builtin_constant_p(hook) && + !static_key_false(&nf_hooks_needed[pf][hook])) + return; +#endif + + rcu_read_lock(); + switch (pf) { + case NFPROTO_IPV4: + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]); + break; + case NFPROTO_IPV6: + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]); + break; + default: + WARN_ON_ONCE(1); + break; } - /* Put passed packets back on main list */ - list_splice(&sublist, head); + + if (hook_head) { + struct nf_hook_state state; + + nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn); + + nf_hook_slow_list(head, &state, hook_head); + } + rcu_read_unlock(); } /* Call setsockopt() */ diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 93aaec3a54ec..3f0bdc728f89 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -536,6 +536,26 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, EXPORT_SYMBOL(nf_hook_slow); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e) +{ + struct sk_buff *skb, *next; + struct list_head sublist; + int ret; + + INIT_LIST_HEAD(&sublist); + + list_for_each_entry_safe(skb, next, head, list) { + skb_list_del_init(skb); + ret = nf_hook_slow(skb, state, e, 0); + if (ret == 1) + list_add_tail(&skb->list, &sublist); + } + /* Put passed packets back on main list */ + list_splice(&sublist, head); +} +EXPORT_SYMBOL(nf_hook_slow_list); + int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) { if (writable_len > skb->len) -- 2.25.1

1 1