- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/7] Revert "quota: Add more checking after reading from quota file"
by Yongqiang Liu 11 Oct '22

11 Oct '22

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187046, https://gitee.com/openeuler/kernel/issues/I5QH0X CVE: NA -------------------------------- This reverts commit f66997d9c183c751a27b2b022dff35bded71571a. The mainline of this patch already exists, revert the interim patch. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/quota/quota_tree.c | 43 ++++++++++--------------------------------- 1 file changed, 10 insertions(+), 33 deletions(-) diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c index 3c600ed3781a..5389cabc6f20 100644 --- a/fs/quota/quota_tree.c +++ b/fs/quota/quota_tree.c @@ -79,12 +79,12 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) return ret; } -static inline int do_check_range(struct super_block *sb, const char *val_name, - uint val, uint min_val, uint max_val) +static inline int do_check_range(struct super_block *sb, uint val, + uint min_val, uint max_val) { if (val < min_val || val >= max_val) { - quota_error(sb, "Getting %s %u out of range %u-%u", - val_name, val, min_val, max_val); + quota_error(sb, "Getting block %u out of range %u-%u", + val, min_val, max_val); return -EUCLEAN; } @@ -98,13 +98,11 @@ static int check_free_block(struct qtree_mem_dqinfo *info, uint nextblk, prevblk; nextblk = le32_to_cpu(dh->dqdh_next_free); - err = do_check_range(info->dqi_sb, "dqdh_next_free", nextblk, 0, - info->dqi_blocks); + err = do_check_range(info->dqi_sb, nextblk, 0, info->dqi_blocks); if (err) return err; prevblk = le32_to_cpu(dh->dqdh_prev_free); - err = do_check_range(info->dqi_sb, "dqdh_prev_free", prevblk, 0, - info->dqi_blocks); + err = do_check_range(info->dqi_sb, prevblk, 0, info->dqi_blocks); if (err) return err; @@ -278,11 +276,6 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info, *err = check_free_block(info, dh); if (*err) goto out_buf; - *err = do_check_range(info->dqi_sb, "dqdh_entries", - le16_to_cpu(dh->dqdh_entries), 0, - qtree_dqstr_in_blk(info)); - if (*err) - goto out_buf; } else { blk = get_free_dqblk(info); if ((int)blk < 0) { @@ -364,10 +357,6 @@ static int do_insert_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, } ref = (__le32 *)buf; newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); - ret = do_check_range(dquot->dq_sb, "block", newblk, 0, - info->dqi_blocks); - if (ret) - goto out_buf; if (!newblk) newson = 1; if (depth == info->dqi_qtree_depth - 1) { @@ -480,11 +469,6 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot, } dh = (struct qt_disk_dqdbheader *)buf; ret = check_free_block(info, dh); - if (ret) - goto out_buf; - ret = do_check_range(info->dqi_sb, "dqdh_entries", - le16_to_cpu(dh->dqdh_entries), 1, - qtree_dqstr_in_blk(info) + 1); if (ret) goto out_buf; le16_add_cpu(&dh->dqdh_entries, -1); @@ -543,7 +527,7 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, goto out_buf; } newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); - ret = do_check_range(dquot->dq_sb, "block", newblk, QT_TREEOFF, + ret = do_check_range(dquot->dq_sb, newblk, QT_TREEOFF, info->dqi_blocks); if (ret) goto out_buf; @@ -647,8 +631,7 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info, blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); if (!blk) /* No reference? */ goto out_buf; - ret = do_check_range(dquot->dq_sb, "block", blk, QT_TREEOFF, - info->dqi_blocks); + ret = do_check_range(dquot->dq_sb, blk, QT_TREEOFF, info->dqi_blocks); if (ret) goto out_buf; @@ -764,13 +747,7 @@ static int find_next_id(struct qtree_mem_dqinfo *info, qid_t *id, goto out_buf; } for (i = __get_index(info, *id, depth); i < epb; i++) { - uint blk_no = le32_to_cpu(ref[i]); - - ret = do_check_range(info->dqi_sb, "block", blk_no, 0, - info->dqi_blocks); - if (ret) - goto out_buf; - if (blk_no == 0) { + if (ref[i] == cpu_to_le32(0)) { *id += level_inc; continue; } @@ -778,7 +755,7 @@ static int find_next_id(struct qtree_mem_dqinfo *info, qid_t *id, ret = 0; goto out_buf; } - ret = find_next_id(info, id, blk_no, depth + 1); + ret = find_next_id(info, id, le32_to_cpu(ref[i]), depth + 1); if (ret != -ENOENT) break; } -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 00/30] linux-4.19-y inclusion
by Yongqiang Liu 11 Oct '22

11 Oct '22

Brian Norris (1): tracefs: Only clobber mode/uid/gid on remount if asked David Hildenbrand (1): mm/hugetlb: fix hugetlb not supporting softdirty tracking Denis V. Lunev (1): neigh: fix possible DoS due to net iface start/stop loop Eric Dumazet (1): tcp: annotate data-race around challenge_timestamp Florian Westphal (2): netfilter: ebtables: reject blobs that don't provide all entry points netfilter: ebtables: fix memory leak when blob is malformed Gaosheng Cui (1): audit: fix potential double free on error path from fsnotify_add_inode_mark Greg Kroah-Hartman (1): debugfs: add debugfs_lookup_and_remove() Harsh Modi (1): netfilter: br_netfilter: Drop dst references before setting. Jann Horn (1): mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() Jonathan Toppins (1): bonding: 802.3ad: fix no transmission of LACPDUs Kuniyuki Iwashima (9): net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. net: Fix a data-race around netdev_budget_usecs. net: Fix a data-race around sysctl_somaxconn. Maciej Żenczykowski (1): net: ipvtap - add __init/__exit annotations to module init/exit funcs Mike Snitzer (1): dm: return early from dm_pr_call() if DM device is suspended Neal Cardwell (1): tcp: fix early ETIMEDOUT after spurious non-SACK RTO NeilBrown (1): SUNRPC: use _bh spinlocking on ->transport_lock Quanyang Wang (1): asm-generic: sections: refactor memory_intersects Siddh Raman Pant (1): loop: Check for overflow while configuring loop Trond Myklebust (1): NFSv4: Fix races in the legacy idmapper upcall Xin Xiong (1): xfrm: fix refcount leak in __xfrm_policy_check() Yang Yingliang (1): net: neigh: don't call kfree_skb() under spin_lock_irqsave() Yee Lee (1): Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" drivers/block/loop.c | 5 +++ drivers/md/dm.c | 5 +++ drivers/net/bonding/bond_3ad.c | 38 ++++++++----------- drivers/net/ipvlan/ipvtap.c | 4 +- fs/debugfs/inode.c | 22 +++++++++++ fs/nfs/nfs4idmap.c | 46 ++++++++++++----------- fs/tracefs/inode.c | 29 ++++++++++---- include/asm-generic/sections.h | 7 +++- include/linux/debugfs.h | 6 +++ include/linux/netfilter_bridge/ebtables.h | 4 -- include/net/busy_poll.h | 2 +- kernel/audit_fsnotify.c | 1 + lib/ratelimit.c | 12 ++++-- mm/kmemleak.c | 8 ++-- mm/mmap.c | 17 +++++++-- net/bridge/br_netfilter_hooks.c | 2 + net/bridge/br_netfilter_ipv6.c | 1 + net/bridge/netfilter/ebtable_broute.c | 8 ---- net/bridge/netfilter/ebtable_filter.c | 8 ---- net/bridge/netfilter/ebtable_nat.c | 8 ---- net/bridge/netfilter/ebtables.c | 10 ++--- net/core/dev.c | 14 +++---- net/core/neighbour.c | 27 ++++++++++--- net/core/skbuff.c | 2 +- net/core/sock.c | 2 +- net/core/sysctl_net_core.c | 15 +++++--- net/ipv4/tcp_input.c | 29 +++++++++----- net/sched/sch_generic.c | 2 +- net/socket.c | 2 +- net/sunrpc/xprt.c | 4 +- net/xfrm/xfrm_policy.c | 1 + 31 files changed, 205 insertions(+), 136 deletions(-) -- 2.25.1

1 30

[PATCH openEuler-1.0-LTS] bonding: fix reference count leak in balance-alb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 4f5d33f4f798b1c6d92b613f0087f639d9836971 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ------------------------------------------------------------------------ Commit d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") introduced a reference count leak by not releasing the reference acquired by ip_dev_find(). Remedy this by insuring the reference is released. Fixes: d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") Signed-off-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://lore.kernel.org/r/26758.1660194413@famine Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index f493bcf..87ad03c 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -680,8 +680,11 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); if (dev) { - if (netif_is_bridge_master(dev)) + if (netif_is_bridge_master(dev)) { + dev_put(dev); return NULL; + } + dev_put(dev); } if (arp->op_code == htons(ARPOP_REPLY)) { -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS] net:bonding:support balance-alb interface with vlan to bridge
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit d5410ac7b0baeca91cf73ff5241d35998ecc8c9e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ----------------------------------------------------------------- In my test, balance-alb bonding with two slaves eth0 and eth1, and then Bond0.150 is created with vlan id attached bond0. After adding bond0.150 into one linux bridge, I noted that Bond0, bond0.150 and bridge were assigned to the same MAC as eth0. Once bond0.150 receives a packet whose dest IP is bridge's and dest MAC is eth1's, the linux bridge will not match eth1's MAC entry in FDB, and not handle it as expected. The patch fix the issue, and diagram as below: eth1(mac:eth1_mac)--bond0(balance-alb,mac:eth0_mac)--eth0(mac:eth0_mac) | bond0.150(mac:eth0_mac) | bridge(ip:br_ip, mac:eth0_mac)--other port Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 856efe8..f493bcf 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -665,6 +665,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) { struct slave *tx_slave = NULL; + struct net_device *dev; struct arp_pkt *arp; if (!pskb_network_may_pull(skb, sizeof(*arp))) @@ -677,6 +678,12 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) if (!bond_slave_has_mac_rx(bond, arp->mac_src)) return NULL; + dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); + if (dev) { + if (netif_is_bridge_master(dev)) + return NULL; + } + if (arp->op_code == htons(ARPOP_REPLY)) { /* the arp must be sent on the selected rx channel */ tx_slave = rlb_choose_channel(skb, bond, arp); -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UY5E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/dri… ------------------------------------------------------------ Since ipv6 neighbor solicitation and advertisement messages isn't handled gracefully in bond6 driver, we can see packet drop due to inconsistency between mac address in the option message and source MAC . Another examples is ipv6 neighbor solicitation and advertisement messages from VM via tap attached to host bridge, the src mac might be changed through balance-alb mode, but it is not synced with Link-layer address in the option message. The patch implements bond6's tx handle for ipv6 neighbor solicitation and advertisement messages. Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Acked-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index a6a89a0..856efe8 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -1281,6 +1281,27 @@ static int alb_set_mac_address(struct bonding *bond, void *addr) return res; } +/* determine if the packet is NA or NS */ +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond) +{ + struct ipv6hdr *ip6hdr; + struct icmp6hdr *hdr; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) + return true; + + ip6hdr = ipv6_hdr(skb); + if (ip6hdr->nexthdr != IPPROTO_ICMPV6) + return false; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr))) + return true; + + hdr = icmp6_hdr(skb); + return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT || + hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION; +} + /************************ exported alb funcions ************************/ int bond_alb_initialize(struct bonding *bond, int rlb_enabled) @@ -1363,10 +1384,12 @@ netdev_tx_t bond_tlb_xmit(struct sk_buff *skb, struct net_device *bond_dev) /* Do not TX balance any multicast or broadcast */ if (!is_multicast_ether_addr(eth_data->h_dest)) { switch (skb->protocol) { + case htons(ETH_P_IPV6): + if (alb_determine_nd(skb, bond)) + break; case htons(ETH_P_IP): case htons(ETH_P_IPX): /* In case of IPX, it will falback to L2 hash */ - case htons(ETH_P_IPV6): hash_index = bond_xmit_hash(bond, skb); if (bond->params.tlb_dynamic_lb) { tx_slave = tlb_choose_channel(bond, @@ -1440,10 +1463,12 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev) break; } - if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) { + if (alb_determine_nd(skb, bond)) { do_tx_balance = false; break; } + + /* The IPv6 header is pulled by alb_determine_nd */ /* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. -- 1.8.3.1

1 0

[PATCH OLK-5.10] bonding: fix reference count leak in balance-alb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 4f5d33f4f798b1c6d92b613f0087f639d9836971 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ------------------------------------------------------------------------------------ Commit d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") introduced a reference count leak by not releasing the reference acquired by ip_dev_find(). Remedy this by insuring the reference is released. Fixes: d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") Signed-off-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://lore.kernel.org/r/26758.1660194413@famine Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index d9c03a9..9130b57 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -665,8 +665,11 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); if (dev) { - if (netif_is_bridge_master(dev)) + if (netif_is_bridge_master(dev)) { + dev_put(dev); return NULL; + } + dev_put(dev); } if (arp->op_code == htons(ARPOP_REPLY)) { -- 1.8.3.1

1 0

[PATCH OLK-5.10] net:bonding:support balance-alb interface with vlan to bridge
by Sun Shouxin 10 Oct '22

10 Oct '22

mainline inclusion from mainline-v6.0 commit d5410ac7b0baeca91cf73ff5241d35998ecc8c9e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… --------------------------------------------------------------- In my test, balance-alb bonding with two slaves eth0 and eth1, and then Bond0.150 is created with vlan id attached bond0. After adding bond0.150 into one linux bridge, I noted that Bond0, bond0.150 and bridge were assigned to the same MAC as eth0. Once bond0.150 receives a packet whose dest IP is bridge's and dest MAC is eth1's, the linux bridge will not match eth1's MAC entry in FDB, and not handle it as expected. The patch fix the issue, and diagram as below: eth1(mac:eth1_mac)--bond0(balance-alb,mac:eth0_mac)--eth0(mac:eth0_mac) | bond0.150(mac:eth0_mac) | bridge(ip:br_ip, mac:eth0_mac)--other port Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 8826380..d9c03a9 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -650,6 +650,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) { struct slave *tx_slave = NULL; + struct net_device *dev; struct arp_pkt *arp; if (!pskb_network_may_pull(skb, sizeof(*arp))) @@ -662,6 +663,12 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) if (!bond_slave_has_mac_rx(bond, arp->mac_src)) return NULL; + dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); + if (dev) { + if (netif_is_bridge_master(dev)) + return NULL; + } + if (arp->op_code == htons(ARPOP_REPLY)) { /* the arp must be sent on the selected rx channel */ tx_slave = rlb_choose_channel(skb, bond, arp); -- 1.8.3.1

1 0

[PATCH OLK-5.10] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
by Sun Shouxin 10 Oct '22

10 Oct '22

mainline inclusion from mainline-v6.0 commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UY5E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/dri… ----------------------------------------------------------- Since ipv6 neighbor solicitation and advertisement messages isn't handled gracefully in bond6 driver, we can see packet drop due to inconsistency between mac address in the option message and source MAC . Another examples is ipv6 neighbor solicitation and advertisement messages from VM via tap attached to host bridge, the src mac might be changed through balance-alb mode, but it is not synced with Link-layer address in the option message. The patch implements bond6's tx handle for ipv6 neighbor solicitation and advertisement messages. Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Acked-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 0436aef9c9ef..882638076355 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -1268,6 +1268,27 @@ static int alb_set_mac_address(struct bonding *bond, void *addr) return res; } +/* determine if the packet is NA or NS */ +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond) +{ + struct ipv6hdr *ip6hdr; + struct icmp6hdr *hdr; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) + return true; + + ip6hdr = ipv6_hdr(skb); + if (ip6hdr->nexthdr != IPPROTO_ICMPV6) + return false; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr))) + return true; + + hdr = icmp6_hdr(skb); + return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT || + hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION; +} + /************************ exported alb funcions ************************/ int bond_alb_initialize(struct bonding *bond, int rlb_enabled) @@ -1347,10 +1368,13 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *bond, /* Do not TX balance any multicast or broadcast */ if (!is_multicast_ether_addr(eth_data->h_dest)) { switch (skb->protocol) { + case htons(ETH_P_IPV6): + if (alb_determine_nd(skb, bond)) + break; + fallthrough; case htons(ETH_P_IP): case htons(ETH_P_IPX): /* In case of IPX, it will falback to L2 hash */ - case htons(ETH_P_IPV6): hash_index = bond_xmit_hash(bond, skb); if (bond->params.tlb_dynamic_lb) { tx_slave = tlb_choose_channel(bond, @@ -1433,10 +1457,12 @@ struct slave *bond_xmit_alb_slave_get(struct bonding *bond, break; } - if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) { + if (alb_determine_nd(skb, bond)) { do_tx_balance = false; break; } + + /* The IPv6 header is pulled by alb_determine_nd */ /* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS 1/3] ext4: check if directory block is within i_size
by Yongqiang Liu 10 Oct '22

10 Oct '22

From: Lukas Czerner <lczerner(a)redhat.com> mainline inclusion from mainline-v6.0-rc1 commit 65f8ea4cd57dbd46ea13b41dc8bac03176b04233 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I58WSQ CVE: CVE-2022-1184 -------------------------------- Currently ext4 directory handling code implicitly assumes that the directory blocks are always within the i_size. In fact ext4_append() will attempt to allocate next directory block based solely on i_size and the i_size is then appropriately increased after a successful allocation. However, for this to work it requires i_size to be correct. If, for any reason, the directory inode i_size is corrupted in a way that the directory tree refers to a valid directory block past i_size, we could end up corrupting parts of the directory tree structure by overwriting already used directory blocks when modifying the directory. Fix it by catching the corruption early in __ext4_read_dirblock(). Addresses Red-Hat-Bugzilla: #2070205 CVE: CVE-2022-1184 Signed-off-by: Lukas Czerner <lczerner(a)redhat.com> Cc: stable(a)vger.kernel.org Reviewed-by: Andreas Dilger <adilger(a)dilger.ca> Link: https://lore.kernel.org/r/20220704142721.157985-1-lczerner@redhat.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/namei.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/namei.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index b2d4fb82e8f4..1a9eda144c7a 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -124,6 +124,13 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, struct ext4_dir_entry *dirent; int is_dx_block = 0; + if (block >= inode->i_size) { + ext4_error_inode(inode, func, line, block, + "Attempting to read directory block (%u) that is past i_size (%llu)", + block, inode->i_size); + return ERR_PTR(-EFSCORRUPTED); + } + bh = ext4_bread(NULL, inode, block, 0); if (IS_ERR(bh)) { __ext4_warning(inode->i_sb, func, line, -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 01/10] md/raid10: prevent unnecessary calls to wake_up() in fast path
by Yongqiang Liu 09 Oct '22

09 Oct '22

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from md-next commit 7fdc91928ac109d3d1468ad7f951deb29a375e3d category: performance bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PRMO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/song/md.git/commit/?h=md-ne… -------------------------------- Currently, wake_up() is called unconditionally in fast path such as raid10_make_request(), which will cause lock contention under high concurrency: raid10_make_request wake_up __wake_up_common_lock spin_lock_irqsave Improve performance by only call wake_up() if waitqueue is not empty. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Signed-off-by: Song Liu <song(a)kernel.org> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/raid10.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 5049c4d829e5..13e0b4a462fc 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -305,6 +305,12 @@ static void put_buf(struct r10bio *r10_bio) lower_barrier(conf); } +static void wake_up_barrier(struct r10conf *conf) +{ + if (wq_has_sleeper(&conf->wait_barrier)) + wake_up(&conf->wait_barrier); +} + static void reschedule_retry(struct r10bio *r10_bio) { unsigned long flags; @@ -1025,7 +1031,7 @@ static void allow_barrier(struct r10conf *conf) { if ((atomic_dec_and_test(&conf->nr_pending)) || (conf->array_freeze_pending)) - wake_up(&conf->wait_barrier); + wake_up_barrier(conf); } static void freeze_array(struct r10conf *conf, int extra) @@ -1584,7 +1590,7 @@ static bool raid10_make_request(struct mddev *mddev, struct bio *bio) __make_request(mddev, bio, sectors); /* In case raid10d snuck in to freeze_array */ - wake_up(&conf->wait_barrier); + wake_up_barrier(conf); return true; } -- 2.25.1

1 9