- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
by Liu Chuang 04 Jun '24

04 Jun '24

From: Eiichi Tsukata <eiichi.tsukata(a)nutanix.com> stable inclusion from stable-v4.19.220 commit 913c24af2d13a3fd304462916ee98e298d56bdce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S23H CVE: CVE-2021-47538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit beacff50edbd6c9659a6f15fc7f6126909fade29 upstream. Need to call rxrpc_put_local() for peer candidate before kfree() as it holds a ref to rxrpc_local. [DH: v2: Changed to abstract the peer freeing code out into a function] Fixes: 9ebeddef58c4 ("rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record") Signed-off-by: Eiichi Tsukata <eiichi.tsukata(a)nutanix.com> Signed-off-by: David Howells <dhowells(a)redhat.com> Reviewed-by: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org Link: https://lore.kernel.org/all/20211121041608.133740-2-eiichi.tsukata@nutanix.… # v1 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- net/rxrpc/peer_object.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c index b91b090217cd..d0a1ebecc6fb 100644 --- a/net/rxrpc/peer_object.c +++ b/net/rxrpc/peer_object.c @@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_sock *rx, return peer; } +static void rxrpc_free_peer(struct rxrpc_peer *peer) +{ + rxrpc_put_local(peer->local); + kfree_rcu(peer, rcu); +} + /* * Set up a new incoming peer. There shouldn't be any other matching peers * since we've already done a search in the list from the non-reentrant context @@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx, spin_unlock_bh(&rxnet->peer_hash_lock); if (peer) - kfree(candidate); + rxrpc_free_peer(candidate); else peer = candidate; } @@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer) list_del_init(&peer->keepalive_link); spin_unlock_bh(&rxnet->peer_hash_lock); - rxrpc_put_local(peer->local); - kfree_rcu(peer, rcu); + rxrpc_free_peer(peer); } /* @@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer) if (n == 0) { hash_del_rcu(&peer->hash_link); list_del_init(&peer->keepalive_link); - rxrpc_put_local(peer->local); - kfree_rcu(peer, rcu); + rxrpc_free_peer(peer); } } -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: set dormant flag on hook register failure
by Guo Mengqi 04 Jun '24

04 Jun '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.211 commit 31ea574aeca1aa488e18716459bde057217637af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJR8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bccebf64701735533c8db37773eeacc6566cc8ec ] We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and we end up with a table marked as active but no registered hooks. On table/base chain deletion, nf_tables will attempt to unregister the hook again which yields a warn splat from the nftables core. Reported-and-tested-by: syzbot+de4025c006ec68ac56fc(a)syzkaller.appspotmail.com Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index a3b86ba2a0f3..cbe22f52d6c4 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1150,6 +1150,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) return 0; err_register_hooks: + ctx->table->flags |= NFT_TABLE_F_DORMANT; nft_trans_destroy(trans); return ret; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-26830
by Guo Mengqi 04 Jun '24

04 Jun '24

CVE-2024-26830 Ivan Vecera (2): i40e: Do not allow untrusted VF to remove administratively set MAC i40e: Fix VF MAC filter removal .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 39 ++++++++++++++++--- 1 file changed, 34 insertions(+), 5 deletions(-) -- 2.17.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-26830
by Guo Mengqi 04 Jun '24

04 Jun '24

CVE-2024-26830 Ivan Vecera (2): i40e: Do not allow untrusted VF to remove administratively set MAC i40e: Fix VF MAC filter removal .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 39 ++++++++++++++++--- 1 file changed, 34 insertions(+), 5 deletions(-) -- 2.17.1

2 3

[PATCH OLK-5.10] Bluetooth: hci_core: Fix possible buffer overflow
by Guo Mengqi 04 Jun '24

04 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.214 commit d47e6c1932cee02954ea588c9f09fd5ecefeadfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HKEA CVE: CVE-2024-26889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 81137162bfaa7278785b24c1fd2e9e74f082e8e4 ] struct hci_dev_info has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its size, so this fixes this problem by switching to use strscpy. Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- net/bluetooth/hci_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 5f1fbf86e0ce..b9cf5bc9364c 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -2175,7 +2175,7 @@ int hci_get_dev_info(void __user *arg) else flags = hdev->flags; - strcpy(di.name, hdev->name); + strscpy(di.name, hdev->name, sizeof(di.name)); di.bdaddr = hdev->bdaddr; di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4); di.flags = flags; -- 2.17.1

2 1

[PATCH OLK-5.10 0/2] iomap: fix sub-page not set dirty state
by Long Li 04 Jun '24

04 Jun '24

This patch set fix sub-page not set dirty state during mmap write. Long Li (2): Revert "iomap: Don't create iomap_page objects in iomap_page_mkwrite_actor" iomap: Ensure sub-page dirty state is set during mmap writes fs/iomap/buffered-io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.31.1

2 3

[PATCH OLK-5.10 V5 0/5] Fix CVE-2023-52732
by Zizhi Wo 04 Jun '24

04 Jun '24

V5: Fix wrong adaptation in ceph_readpage_to_fscache() and ceph_readpage_from_fscache(). V4: Fix wrong adaptation in ceph_mdsc_sync(). V3: Fix wrong adaptation in remove_session_caps_cb(). V2: Modify conflicting files in the commit message. V1: Fix main error. Jeff Layton (4): ceph: drop private list from remove_session_caps_cb ceph: fix auth cap handling logic in remove_session_caps_cb ceph: refactor remove_session_caps_cb ceph: shut down access to inode when async create fails Xiubo Li (1): ceph: blocklist the kclient when receiving corrupted snap trace fs/ceph/addr.c | 24 ++++-- fs/ceph/cache.c | 6 ++ fs/ceph/caps.c | 138 +++++++++++++++++++++++++++++++-- fs/ceph/export.c | 12 ++- fs/ceph/file.c | 13 +++- fs/ceph/inode.c | 33 +++++++- fs/ceph/locks.c | 7 ++ fs/ceph/mds_client.c | 144 ++++++++--------------------------- fs/ceph/snap.c | 36 ++++++++- fs/ceph/super.h | 12 +++ include/linux/ceph/libceph.h | 1 + 11 files changed, 296 insertions(+), 130 deletions(-) -- 2.39.2

2 6

[PATCH OLK-5.10 V5 0/5] Fix CVE-2023-52732
by Zizhi Wo 04 Jun '24

04 Jun '24

V5: Fix wrong adaptation in ceph_readpage_to_fscache() and ceph_readpage_from_fscache(). V4: Fix wrong adaptation in ceph_mdsc_sync(). V3: Fix wrong adaptation in remove_session_caps_cb(). V2: Modify conflicting files in the commit message. V1: Fix main error. Jeff Layton (4): ceph: drop private list from remove_session_caps_cb ceph: fix auth cap handling logic in remove_session_caps_cb ceph: refactor remove_session_caps_cb ceph: shut down access to inode when async create fails Xiubo Li (1): ceph: blocklist the kclient when receiving corrupted snap trace fs/ceph/addr.c | 24 ++++-- fs/ceph/cache.c | 6 ++ fs/ceph/caps.c | 138 +++++++++++++++++++++++++++++++-- fs/ceph/export.c | 12 ++- fs/ceph/file.c | 13 +++- fs/ceph/inode.c | 33 +++++++- fs/ceph/locks.c | 7 ++ fs/ceph/mds_client.c | 144 ++++++++--------------------------- fs/ceph/snap.c | 36 ++++++++- fs/ceph/super.h | 12 +++ include/linux/ceph/libceph.h | 1 + 11 files changed, 296 insertions(+), 130 deletions(-) -- 2.39.2

2 6

[PATCH OLK-5.10 V5 0/5] Fix CVE-2023-52732
by Zizhi Wo 04 Jun '24

04 Jun '24

V5: Fix wrong adaptation in ceph_readpage_to_fscache() and ceph_readpage_from_fscache(). V4: Fix wrong adaptation in ceph_mdsc_sync(). V3: Fix wrong adaptation in remove_session_caps_cb(). V2: Modify conflicting files in the commit message. V1: Fix main error. Jeff Layton (4): ceph: drop private list from remove_session_caps_cb ceph: fix auth cap handling logic in remove_session_caps_cb ceph: refactor remove_session_caps_cb ceph: shut down access to inode when async create fails Xiubo Li (1): ceph: blocklist the kclient when receiving corrupted snap trace fs/ceph/addr.c | 24 ++++-- fs/ceph/cache.c | 6 ++ fs/ceph/caps.c | 138 +++++++++++++++++++++++++++++++-- fs/ceph/export.c | 12 ++- fs/ceph/file.c | 13 +++- fs/ceph/inode.c | 33 +++++++- fs/ceph/locks.c | 7 ++ fs/ceph/mds_client.c | 144 ++++++++--------------------------- fs/ceph/snap.c | 36 ++++++++- fs/ceph/super.h | 12 +++ include/linux/ceph/libceph.h | 1 + 11 files changed, 296 insertions(+), 130 deletions(-) -- 2.39.2

2 7

[PATCH openEuler-22.03-LTS-SP1] geneve: fix header validation in geneve[6]_xmit_skb
by Dong Chenchen 04 Jun '24

04 Jun '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.216 commit 10204df9beda4978bd1d0c2db0d8375bfb03b915 category: bugfix bugzilla: 190035, https://gitee.com/src-openeuler/kernel/issues/I9QRAK CVE: CVE-2024-35973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d8a6213d70accb403b82924a1c229e733433a5ef ] syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol. If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol, pskb_inet_may_pull() does nothing at all. If a vlan tag was provided by the caller (af_packet in the syzbot case), the network header might not point to the correct location, and skb linear part could be smaller than expected. Add skb_vlan_inet_prepare() to perform a complete mac validation. Use this in geneve for the moment, I suspect we need to adopt this more broadly. v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest - Only call __vlan_get_protocol() for vlan types. Link: https://lore.kernel.org/netdev/20240404100035.3270a7d5@kernel.org/ v2,v3 - Addressed Sabrina comments on v1 and v2 Link: https://lore.kernel.org/netdev/Zg1l9L2BNoZWZDZG@hog/ [1] BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 geneve_xmit_skb drivers/net/geneve.c:910 [inline] geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Fixes: d13f048dd40e ("net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb") Reported-by: syzbot+9ee20ec1de7b3168db09(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/000000000000d19c3a06152f9ee4@google.com/ Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Phillip Potter <phil(a)philpotter.co.uk> Cc: Sabrina Dubroca <sd(a)queasysnail.net> Reviewed-by: Sabrina Dubroca <sd(a)queasysnail.net> Reviewed-by: Phillip Potter <phil(a)philpotter.co.uk> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/geneve.c | 4 ++-- include/net/ip_tunnels.h | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index 081939cb420b..65722f844f8a 100644 --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -893,7 +893,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, __be16 sport; int err; - if (!pskb_inet_may_pull(skb)) + if (!skb_vlan_inet_prepare(skb)) return -EINVAL; sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); @@ -990,7 +990,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, __be16 sport; int err; - if (!pskb_inet_may_pull(skb)) + if (!skb_vlan_inet_prepare(skb)) return -EINVAL; sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h index 1ddd401a8981..219b407a6607 100644 --- a/include/net/ip_tunnels.h +++ b/include/net/ip_tunnels.h @@ -333,6 +333,39 @@ static inline bool pskb_inet_may_pull(struct sk_buff *skb) return pskb_network_may_pull(skb, nhlen); } +/* Variant of pskb_inet_may_pull(). + */ +static inline bool skb_vlan_inet_prepare(struct sk_buff *skb) +{ + int nhlen = 0, maclen = ETH_HLEN; + __be16 type = skb->protocol; + + /* Essentially this is skb_protocol(skb, true) + * And we get MAC len. + */ + if (eth_type_vlan(type)) + type = __vlan_get_protocol(skb, type, &maclen); + + switch (type) { +#if IS_ENABLED(CONFIG_IPV6) + case htons(ETH_P_IPV6): + nhlen = sizeof(struct ipv6hdr); + break; +#endif + case htons(ETH_P_IP): + nhlen = sizeof(struct iphdr); + break; + } + /* For ETH_P_IPV6/ETH_P_IP we make sure to pull + * a base network header in skb->head. + */ + if (!pskb_may_pull(skb, maclen + nhlen)) + return false; + + skb_set_network_header(skb, maclen); + return true; +} + static inline int ip_encap_hlen(struct ip_tunnel_encap *e) { const struct ip_tunnel_encap_ops *ops; -- 2.25.1

2 1