- Kernel - mailweb.openeuler.org

[PATCH 4.19 1/6] dm thin metadata: check fail_io before using data_sm
by Yongqiang Liu 08 Aug '23

08 Aug '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> mainline inclusion from mainline-v6.4-rc8 commit cb65b282c9640c27d3129e2e04b711ce1b352838 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7FIUX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- Must check pmd->fail_io before using pmd->data_sm since pmd->data_sm may be destroyed by other processes. P1(kworker) P2(message) do_worker process_prepared process_prepared_discard_passdown_pt2 dm_pool_dec_data_range pool_message commit dm_pool_commit_metadata ↓ // commit failed metadata_operation_failed abort_transaction dm_pool_abort_metadata __open_or_format_metadata ↓ dm_sm_disk_open ↓ // open failed // pmd->data_sm is NULL dm_sm_dec_blocks ↓ // try to access pmd->data_sm --> UAF As shown above, if dm_pool_commit_metadata() and dm_pool_abort_metadata() fail in pool_message process, kworker may trigger UAF. Fixes: be500ed721a6 ("dm space maps: improve performance with inc/dec on ranges of blocks") Cc: stable(a)vger.kernel.org Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Conflicts: drivers/md/dm-thin-metadata.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin-metadata.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index e37f468cdbf0..bd9466dc9400 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -1711,13 +1711,15 @@ int dm_thin_remove_range(struct dm_thin_device *td, int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result) { - int r; + int r = -EINVAL; uint32_t ref_count; down_read(&pmd->root_lock); - r = dm_sm_get_count(pmd->data_sm, b, &ref_count); - if (!r) - *result = (ref_count > 1); + if (!pmd->fail_io) { + r = dm_sm_get_count(pmd->data_sm, b, &ref_count); + if (!r) + *result = (ref_count > 1); + } up_read(&pmd->root_lock); return r; @@ -1728,10 +1730,14 @@ int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_ int r = 0; down_write(&pmd->root_lock); - for (; b != e; b++) { - r = dm_sm_inc_block(pmd->data_sm, b); - if (r) - break; + if (!pmd->fail_io) { + for (; b != e; b++) { + r = dm_sm_inc_block(pmd->data_sm, b); + if (r) + break; + } + } else { + r = -EINVAL; } up_write(&pmd->root_lock); @@ -1743,10 +1749,14 @@ int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_ int r = 0; down_write(&pmd->root_lock); - for (; b != e; b++) { - r = dm_sm_dec_block(pmd->data_sm, b); - if (r) - break; + if (!pmd->fail_io) { + for (; b != e; b++) { + r = dm_sm_dec_block(pmd->data_sm, b); + if (r) + break; + } + } else { + r = -EINVAL; } up_write(&pmd->root_lock); -- 2.25.1

1 5

[PATCH OLK-5.10] nvme-pci: fix mempool alloc size
by Yong Hu 08 Aug '23

08 Aug '23

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v5.10.188 commit dfb6d54893d544151e7f480bc44cfe7823f5ad23 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit c89a529e823d51dd23c7ec0c047c7a454a428541 ] Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool. While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence. Cc: Jens Axboe <axboe(a)kernel.dk> Fixes: 943e942e6266f ("nvme-pci: limit max IO size and segments to avoid high order allocations") Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 510ce0c145c7..ef2fcd0ed914 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -372,8 +372,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, */ static int nvme_pci_npages_prp(void) { - unsigned nprps = DIV_ROUND_UP(NVME_MAX_KB_SZ + NVME_CTRL_PAGE_SIZE, - NVME_CTRL_PAGE_SIZE); + unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; + unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); return DIV_ROUND_UP(8 * nprps, PAGE_SIZE - 8); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v4 0/3] Mainline bugfix patches backport 4.19
by Guo Mengqi 08 Aug '23

08 Aug '23

Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 +++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 ++++++++++++++++-- lib/genalloc.c | 3 ++- 4 files changed, 34 insertions(+), 8 deletions(-) -- 2.17.1

2 4

[PATCH OLK-5.10] evm: add sm3 config for EVM
by Zhou Shuiqing 08 Aug '23

08 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R99G CVE: NA ------------------------------- Add sm3 algo config for EVM hash algorithm Signed-off-by: Zhou Shuiqing <zhoushuiqing2(a)huawei.com> --- security/integrity/evm/Kconfig | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig index 844f2686cce7..b9a6eb651acf 100644 --- a/security/integrity/evm/Kconfig +++ b/security/integrity/evm/Kconfig @@ -35,6 +35,10 @@ choice config EVM_DEFAULT_HASH_WP512 bool "WP512" depends on CRYPTO_WP512=y + + config EVM_DEFAULT_HASH_SM3 + bool "SM3" + depends on CRYPTO_SM3=y endchoice config EVM_DEFAULT_HASH @@ -44,6 +48,7 @@ config EVM_DEFAULT_HASH default "sha256" if EVM_DEFAULT_HASH_SHA256 default "sha512" if EVM_DEFAULT_HASH_SHA512 default "wp512" if EVM_DEFAULT_HASH_WP512 + default "sm3" if EVM_DEFAULT_HASH_SM3 config EVM_ATTR_FSUUID bool "FSUUID (version 2)" -- 2.33.0

2 1

[PATCH OLK-5.10] uacce: delete the pointer address printing
by Weili Qian 08 Aug '23

08 Aug '23

From: Kai Ye <yekai13(a)huawei.com> driver inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/I7R6TQ CVE: NA ---------------------------------------------------------------------- Deleted the kernel pointer address printing by the security check. Signed-off-by: Kai Ye <yekai13(a)huawei.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> --- drivers/misc/uacce/uacce.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 6d2961676a54..21a4f5892aff 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -177,10 +177,8 @@ static long uacce_get_ss_dma(struct uacce_queue *q, void __user *arg) size = slice[slice_idx].size; if (!size) { max_idx = slice[0].total_num - 1; - dev_err(&uacce->dev, "%luth ss region[0x%lx, %lu] no exist, range[[0](0x%llx, %llu) -> [%u](0x%llx, %llu)]\n", - slice_idx, dma, size, - slice[0].dma, slice[0].size, max_idx, - slice[max_idx].dma, slice[max_idx].size); + dev_err(&uacce->dev, "%luth ss region[size = %lu] no exist, range[[0](size = %llu) -> [%u](size = %llu)]\n", + slice_idx, size, slice[0].size, max_idx, slice[max_idx].size); ret = -ENODEV; goto param_check; } @@ -209,9 +207,7 @@ static void uacce_free_dma_buffers(struct uacce_queue *q) return; while (i < qfr->dma_list[0].total_num) { WARN_ON(!qfr->dma_list[i].size || !qfr->dma_list[i].dma); - dev_dbg(pdev, "free dma qfr (kaddr=%lx, dma=%llx)\n", - (unsigned long)(uintptr_t)qfr->dma_list[i].kaddr, - qfr->dma_list[i].dma); + dev_dbg(pdev, "free dma qfr (index = %d)\n", i); dma_free_coherent(pdev, qfr->dma_list[i].size, qfr->dma_list[i].kaddr, qfr->dma_list[i].dma); @@ -550,8 +546,8 @@ static int uacce_alloc_dma_buffers(struct uacce_queue *q, PAGE_SIZE - 1) & PAGE_MASK, &slice[i].dma, GFP_KERNEL); if (!slice[i].kaddr) { - dev_err(pdev, "Get dma slice(sz=%lu,dma=0x%llx) fail!\n", - size, slice[i].dma); + dev_err(pdev, "get dma slice(sz = %lu,slice num = %d) fail!\n", + size, i); slice[0].total_num = i; uacce_free_dma_buffers(q); return -ENOMEM; @@ -594,8 +590,8 @@ static int uacce_mmap_dma_buffers(struct uacce_queue *q, slice[i].dma, slice[i].size); if (ret) { - dev_err(pdev, "dma mmap fail(dma=0x%llx,size=0x%llx)!\n", - slice[i].dma, slice[i].size); + dev_err(pdev, "dma mmap fail(dma index = %d, size = %llu)!\n", + i, slice[i].size); goto DMA_MMAP_FAIL; } @@ -846,10 +842,11 @@ static ssize_t dev_state_show(struct device *dev, static ssize_t node_id_show(struct device *dev, struct device_attribute *attr, char *buf) { - struct uacce_device *uacce = to_uacce_device(dev); int node_id = -1; #ifdef CONFIG_NUMA + struct uacce_device *uacce = to_uacce_device(dev); + node_id = uacce->parent->numa_node; #endif return sysfs_emit(buf, "%d\n", node_id); @@ -858,10 +855,11 @@ static ssize_t node_id_show(struct device *dev, static ssize_t numa_distance_show(struct device *dev, struct device_attribute *attr, char *buf) { - struct uacce_device *uacce = to_uacce_device(dev); int distance = 0; #ifdef CONFIG_NUMA + struct uacce_device *uacce = to_uacce_device(dev); + distance = node_distance(uacce->parent->numa_node, cpu_to_node(smp_processor_id())); #endif -- 2.30.0

2 1

[PATCH OLK-5.10] mm/ksm: Remove the ksm_merge_any status
by Longlong Xia 08 Aug '23

08 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R48G ---------------------------------------------------------------------- Remove the ksm_merge_any status, as the ksm status of processes within the same cgroup may not be consistent, since the prctl interface can also change the ksm status of a process. Therefore, the ksm_merge_any status may not always represent the ksm status of all processes within a cgroup. Remove it. Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> --- include/linux/memcontrol.h | 4 ---- mm/memcontrol.c | 9 --------- 2 files changed, 13 deletions(-) diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 16b3666393f2..0219e670a436 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -402,11 +402,7 @@ struct mem_cgroup { KABI_RESERVE(3) KABI_RESERVE(4) #endif -#ifdef CONFIG_KSM - KABI_USE(5, bool ksm_merge_any) -#else KABI_RESERVE(5) -#endif #if defined(CONFIG_DYNAMIC_HUGETLB) && defined(CONFIG_ARM64) KABI_USE(6, struct dhugetlb_pool *hpool) #else diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 5082d0664adf..c32010692a1b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5724,9 +5724,6 @@ static int memcg_set_ksm_for_tasks(struct mem_cgroup *memcg, bool enable) struct css_task_iter it; int ret = 0; - if (enable == READ_ONCE(memcg->ksm_merge_any)) - return 0; - css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); while (!ret && (task = css_task_iter_next(&it))) { if (__task_is_dying(task)) @@ -5781,7 +5778,6 @@ static int memory_ksm_show(struct seq_file *m, void *v) } css_task_iter_end(&it); - seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); seq_printf(m, "merge any tasks: %u\n", tasks); seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); @@ -5808,8 +5804,6 @@ static ssize_t memory_ksm_write(struct kernfs_open_file *of, char *buf, if (err) return err; - WRITE_ONCE(memcg->ksm_merge_any, enable); - return nbytes; } #endif /* CONFIG_KSM */ @@ -6374,9 +6368,6 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) if (parent != root_mem_cgroup) memory_cgrp_subsys.broken_hierarchy = true; } -#ifdef CONFIG_KSM - memcg->ksm_merge_any = false; -#endif /* The following stuff does not apply to the root */ if (!parent) { root_mem_cgroup = memcg; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v3 0/4] Mainline bugfix patches backport 4.19
by Guo Mengqi 07 Aug '23

07 Aug '23

Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE drivers/base/base.h | 1 + drivers/base/core.c | 35 ++++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 ++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 +++++++++++++++-- lib/genalloc.c | 3 ++- 7 files changed, 73 insertions(+), 9 deletions(-) -- 2.17.1

2 5

[PATCH OLK-5.10 v3 0/4] Mainline bugfix patches backport 5.10
by Guo Mengqi 07 Aug '23

07 Aug '23

Andy Shevchenko (1): lib/cmdline: fix get_option() for strings starting with hyphen Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Sumera Priyadarsini (1): bus: arm-integrator-lm: Add of_node_put() before return statement drivers/base/base.h | 1 + drivers/base/core.c | 35 +++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/bus/arm-integrator-lm.c | 1 + lib/cmdline.c | 8 +++++++- lib/genalloc.c | 3 ++- 6 files changed, 49 insertions(+), 3 deletions(-) -- 2.17.1

1 4

[PATCH OLK-5.10 0/4] Mainilne bugfix patches backport
by Guo Mengqi 07 Aug '23

07 Aug '23

Andy Shevchenko (1): lib/cmdline: fix get_option() for strings starting with hyphen Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Sumera Priyadarsini (1): bus: arm-integrator-lm: Add of_node_put() before return statement drivers/base/base.h | 1 + drivers/base/core.c | 35 +++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/bus/arm-integrator-lm.c | 1 + lib/cmdline.c | 8 +++++++- lib/genalloc.c | 3 ++- 6 files changed, 49 insertions(+), 3 deletions(-) -- 2.17.1

2 5

[PATCH openEuler-1.0-LTS 0/4] Mainline bugfix patches backport
by Guo Mengqi 07 Aug '23

07 Aug '23

Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE drivers/base/base.h | 1 + drivers/base/core.c | 35 ++++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 ++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 +++++++++++++++-- lib/genalloc.c | 3 ++- 7 files changed, 73 insertions(+), 9 deletions(-) -- 2.17.1

2 5