- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] netfilter: nf_tables: reject QUEUE/DROP verdict parameters
by Dong Chenchen 04 Feb '24

04 Feb '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.8-rc2 commit f342de4e2f33e0e39165d8639387aa6c19dff660 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I90B2K CVE: CVE-2024-1086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This reverts commit e0abdadcc6e1. core.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP verdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar, or 0. Due to the reverted commit, its possible to provide a positive value, e.g. NF_ACCEPT (1), which results in use-after-free. Its not clear to me why this commit was made. NF_QUEUE is not used by nftables; "queue" rules in nftables will result in use of "nft_queue" expression. If we later need to allow specifiying errno values from userspace (do not know why), this has to call NF_DROP_GETERR and check that "err <= 0" holds true. Fixes: e0abdadcc6e1 ("netfilter: nf_tables: accept QUEUE/DROP verdict parameters") Cc: stable(a)vger.kernel.org Reported-by: Notselwyn <notselwyn(a)pwning.tech> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index e07c497e7344..3ee5beb220bd 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7175,16 +7175,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); switch (data->verdict.code) { - default: - switch (data->verdict.code & NF_VERDICT_MASK) { - case NF_ACCEPT: - case NF_DROP: - case NF_QUEUE: - break; - default: - return -EINVAL; - } - /* fall through */ + case NF_ACCEPT: + case NF_DROP: + case NF_QUEUE: + break; case NFT_CONTINUE: case NFT_BREAK: case NFT_RETURN: @@ -7203,6 +7197,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, chain->use++; data->verdict.chain = chain; break; + default: + return -EINVAL; } desc->len = sizeof(data->verdict); -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/ascend: Make enable_oom_killer feature depends on ASCEND_FEATURE
by Yuan Can 04 Feb '24

04 Feb '24

ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I90WBX CVE: NA ------------------------------------------------- The enable_oom_killer feature is only used on ascend platform, make its config depends on ASCEND_FEATURE. Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 1 - mm/Kconfig | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 77f0c7ae79c1..d4027ab5893a 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -1171,7 +1171,6 @@ CONFIG_LRU_GEN=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y -# CONFIG_ASCEND_OOM is not set # CONFIG_PAGE_CACHE_LIMIT is not set CONFIG_DYNAMIC_POOL=y CONFIG_ETMEM_SCAN=m diff --git a/mm/Kconfig b/mm/Kconfig index f45bc11c1cb2..56f80e2e3a6f 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1314,6 +1314,7 @@ config SHARE_POOL config ASCEND_OOM bool "Enable support for disable oom killer" + depends on ASCEND_FEATURES default n help In some cases we hopes that the oom will not kill the process when it occurs, -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52340
by Ziyang Xuan 04 Feb '24

04 Feb '24

The patchset for CVE-2023-52340. Jon Maxwell (2): ipv6: remove max_size check inline with ipv4 ipv6: Document that max_size sysctl is deprecated Documentation/networking/ip-sysctl.txt | 3 +++ include/net/dst_ops.h | 2 +- net/core/dst.c | 8 ++------ net/ipv6/route.c | 13 +++++-------- 4 files changed, 11 insertions(+), 15 deletions(-) -- 2.25.1

2 3

[PATCH v5 OLK-6.6 00/22] kabi reserve patches
by Lin Yujun 04 Feb '24

04 Feb '24

*** BLURB HERE *** Chen Jiahao (1): KABI: reserve space for struct input_dev Jialin Zhang (1): kabi: reserve space for power management related structure Lin Ruizhe (5): msi: Add kabi_reserve in msi.h interrupt: Add kabi_reserve in interrupt.h irq: Add kabi_reserve in irq irq_desc: Add kabi_reserve in irq_desc irqdomain: Add kabi_reserve in irqdomain Lin Yujun (14): drm: drm_atomic.h: Add kabi_reserve drm: drm_client.h: Add kabi_reserve drm: drm_connector.h: Add kabi_reserve drm: drm_crtc.h: Add kabi_reserve drm: drm_device.h: Add kabi_reserve drm: drm_drv.h: Add kabi_reserve drm: drm_fb_helper.h: Add kabi_reserve drm: drm_file.h: Add kabi_reserve drm: drm_fourcc.h: Add kabi_reserve drm: drm_gem.h: Add kabi_reserve pm: pm_domain.h: Add kabi_reserve pm: pm.h: Add kabi_reserve energy_model: Add kabi_reserve kabi: reserve space for arm64 cpufeature related structure Yang Yingliang (1): kabi: reserve space for struct cpu_stop_work arch/arm64/tools/cpucaps | 30 ++++++++++++++++++++++++++++++ include/drm/drm_atomic.h | 6 ++++++ include/drm/drm_client.h | 7 +++++++ include/drm/drm_connector.h | 18 ++++++++++++++++++ include/drm/drm_crtc.h | 7 +++++++ include/drm/drm_device.h | 4 ++++ include/drm/drm_drv.h | 5 +++++ include/drm/drm_fb_helper.h | 8 ++++++++ include/drm/drm_file.h | 8 ++++++++ include/drm/drm_fourcc.h | 5 +++++ include/drm/drm_gem.h | 8 ++++++++ include/linux/energy_model.h | 5 +++++ include/linux/input.h | 4 ++++ include/linux/interrupt.h | 6 ++++++ include/linux/irq.h | 8 ++++++++ include/linux/irqdesc.h | 4 +++- include/linux/irqdomain.h | 3 +++ include/linux/msi.h | 7 +++++++ include/linux/pm.h | 14 ++++++++++++++ include/linux/pm_domain.h | 10 ++++++++++ include/linux/pm_qos.h | 7 +++++++ include/linux/pm_wakeup.h | 4 ++++ include/linux/stop_machine.h | 3 +++ 23 files changed, 180 insertions(+), 1 deletion(-) -- 2.34.1

2 23

[PATCH OLK-6.6 0/2] change zswap's default allocator to zsmalloc
by Ze Zuo 04 Feb '24

04 Feb '24

Considering that zsmalloc has already supported writeback capability and zswap LRU optimization, changing the default allocator of zpool in zswap from zbud to zsmalloc. Nhat Pham (1): zswap: change zswap's default allocator to zsmalloc Ze Zuo (1): openeuler_defconfig: set ZSWAP_ZPOOL_DEFAULT to ZSMALLOC arch/arm64/configs/openeuler_defconfig | 6 +++--- arch/x86/configs/openeuler_defconfig | 6 +++--- mm/Kconfig | 1 + 3 files changed, 7 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/4] memory tiering: calculate abstract distance based on ACPI HMAT
by Tong Tiangen 04 Feb '24

04 Feb '24

We have the explicit memory tiers framework to manage systems with multiple types of memory, e.g., DRAM in DIMM slots and CXL memory devices. Where, same kind of memory devices will be grouped into memory types, then put into memory tiers. To describe the performance of a memory type, abstract distance is defined. Which is in direct proportion to the memory latency and inversely proportional to the memory bandwidth. To keep the code as simple as possible, fixed abstract distance is used in dax/kmem to describe slow memory such as Optane DCPMM. To support more memory types, in this series, we added the abstract distance calculation algorithm management mechanism, provided a algorithm implementation based on ACPI HMAT, and used the general abstract distance calculation interface in dax/kmem driver. So, dax/kmem can support HBM (high bandwidth memory) in addition to the original Optane DCPMM. Huang Ying (4): memory tiering: add abstract distance calculation algorithms management acpi, hmat: refactor hmat_register_target_initiators() acpi, hmat: calculate abstract distance with HMAT dax, kmem: calculate abstract distance with general interface drivers/acpi/numa/hmat.c | 146 ++++++++++++++++++++----------- drivers/dax/kmem.c | 62 ++++++++++--- include/linux/memory-tiers.h | 39 +++++++++ mm/memory-tiers.c | 165 ++++++++++++++++++++++++++++++++++- 4 files changed, 344 insertions(+), 68 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6] arm64/ascend: Make enable_oom_killer feature works on ARM64 only
by Yuan Can 04 Feb '24

04 Feb '24

ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I90WBX CVE: NA ------------------------------------------------- The enable_oom_killer feature is only used on arm64 platform, make its config depends on ARM64. Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 1 - mm/Kconfig | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 77f0c7ae79c1..d4027ab5893a 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -1171,7 +1171,6 @@ CONFIG_LRU_GEN=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y -# CONFIG_ASCEND_OOM is not set # CONFIG_PAGE_CACHE_LIMIT is not set CONFIG_DYNAMIC_POOL=y CONFIG_ETMEM_SCAN=m diff --git a/mm/Kconfig b/mm/Kconfig index f45bc11c1cb2..e3a0e0076716 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1314,6 +1314,7 @@ config SHARE_POOL config ASCEND_OOM bool "Enable support for disable oom killer" + depends on ARM64 default n help In some cases we hopes that the oom will not kill the process when it occurs, -- 2.17.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: enable CONFIG_PAGE_CACHE_LIMIT
by Ze Zuo 04 Feb '24

04 Feb '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8NIKC -------------------------------- Enable CONFIG_PAGE_CACHE_LIMIT for x86, arm64 by default. Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 2ddea5999010..e6c9474e032a 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1161,7 +1161,7 @@ CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y # CONFIG_ASCEND_FEATURES is not set # CONFIG_ASCEND_OOM is not set -# CONFIG_PAGE_CACHE_LIMIT is not set +CONFIG_PAGE_CACHE_LIMIT=y # CONFIG_CLEAR_FREELIST_PAGE is not set CONFIG_MEMORY_RELIABLE=y CONFIG_DYNAMIC_POOL=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 77f0c7ae79c1..e97820a0ec30 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -1172,7 +1172,7 @@ CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y # CONFIG_ASCEND_OOM is not set -# CONFIG_PAGE_CACHE_LIMIT is not set +CONFIG_PAGE_CACHE_LIMIT=y CONFIG_DYNAMIC_POOL=y CONFIG_ETMEM_SCAN=m CONFIG_ETMEM_SWAP=m -- 2.25.1

2 1

[PATCH OLK-6.6 v2] kabi:dma:add kabi reserve for dma_map_ops structure
by Ze Zuo 04 Feb '24

04 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZYKD --------------------------- Reserve space for dma_map_ops on dma-map-ops.h. Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- include/linux/dma-map-ops.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h index f2fc203fb8a1..a37e85e7a5c6 100644 --- a/include/linux/dma-map-ops.h +++ b/include/linux/dma-map-ops.h @@ -82,6 +82,12 @@ struct dma_map_ops { size_t (*max_mapping_size)(struct device *dev); size_t (*opt_mapping_size)(void); unsigned long (*get_merge_boundary)(struct device *dev); + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) }; #ifdef CONFIG_DMA_OPS -- 2.25.1

2 1

[PATCH] arm64/ascend: Make enable_oom_killer feature works on ARM64 only
by Yuan Can 04 Feb '24

04 Feb '24

ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I90WBX CVE: NA ------------------------------------------------- The enable_oom_killer feature is only used on arm64 platform, make its config depends on ARM64. Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- mm/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/Kconfig b/mm/Kconfig index f45bc11c1cb2..e3a0e0076716 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1314,6 +1314,7 @@ config SHARE_POOL config ASCEND_OOM bool "Enable support for disable oom killer" + depends on ARM64 default n help In some cases we hopes that the oom will not kill the process when it occurs, -- 2.17.1

1 0