- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/7] Some folio bugfix
by Liu Shixin 22 Jun '24

22 Jun '24

Some folio bugfix. Andrew Bresticker (1): mm/memory: don't require head page for do_set_pmd() Baolin Wang (2): mm: support multi-size THP numa balancing mm: shmem: fix getting incorrect lruvec when replacing a shmem folio Hugh Dickins (1): mm/migrate: fix kernel BUG at mm/compaction.c:2761! Kefeng Wang (1): mm: fix possible OOB in numa_rebuild_large_mapping() Ran Xiaokai (1): mm: huge_memory: fix misused mapping_large_folio_support() for anon folios Zi Yan (1): mm/rmap: do not add fully unmapped large folio to deferred split list include/linux/pagemap.h | 4 +++ mm/huge_memory.c | 28 +++++++++------- mm/memcontrol.c | 3 +- mm/memory.c | 71 +++++++++++++++++++++++++++++++++-------- mm/migrate.c | 8 ++++- mm/mprotect.c | 3 +- mm/rmap.c | 13 ++++++-- mm/shmem.c | 2 +- 8 files changed, 100 insertions(+), 32 deletions(-) -- 2.25.1

2 8

[PATCH openEuler-1.0-LTS] ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
by Liu Chuang 22 Jun '24

22 Jun '24

From: Mark Brown <broonie(a)kernel.org> stable inclusion from stable-v4.19.228 commit 7659f25a80e6affb784b690df8994b79b4212fd4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA72KY CVE: CVE-2022-48736 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 4cf28e9ae6e2e11a044be1bcbcfa1b0d8675fe4d upstream. We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range. Signed-off-by: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20220124153253.3548853-4-broonie@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- sound/soc/soc-ops.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 3980b1727c49..ef8fd331526b 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -910,6 +910,8 @@ int snd_soc_put_xr_sx(struct snd_kcontrol *kcontrol, unsigned int i, regval, regmask; int err; + if (val < mc->min || val > mc->max) + return -EINVAL; if (invert) val = max - val; val &= mask; -- 2.34.1

2 1

[PATCH OLK-6.6] af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
by Liu Jian 22 Jun '24

22 Jun '24

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.33 commit 0688d4e499bee3f2749bca27329bd128686230cb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SCO CVE: CVE-2024-38596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ] A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writes to sk->sk_shutdown using WRITE_ONCE. However, on the reader side, unix_stream_sendmsg() does not read it atomically. Consequently, this issue is causing the following KCSAN splat to occur: BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: unix_release_sock (net/unix/af_unix.c:640) unix_release (net/unix/af_unix.c:1050) sock_close (net/socket.c:659 net/socket.c:1421) __fput (fs/file_table.c:422) __fput_sync (fs/file_table.c:508) __se_sys_close (fs/open.c:1559 fs/open.c:1541) __x64_sys_close (fs/open.c:1541) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: unix_stream_sendmsg (net/unix/af_unix.c:2273) __sock_sendmsg (net/socket.c:730 net/socket.c:745) ____sys_sendmsg (net/socket.c:2584) __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x01 -> 0x03 The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7"). Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") addressed a comparable issue in the past regarding sk->sk_shutdown. However, it overlooked resolving this particular data path. This patch only offending unix_stream_sendmsg() function, since the other reads seem to be protected by unix_state_lock() as discussed in Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@amazon.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@debian.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/unix/af_unix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 6eab35a5e2f3..aaa4d7878b5d 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2199,7 +2199,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, goto out_err; } - if (sk->sk_shutdown & SEND_SHUTDOWN) + if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) goto pipe_err; while (sent < len) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-38596
by Liu Jian 22 Jun '24

22 Jun '24

CVE-2024-38596 Breno Leitao (1): af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg Kuniyuki Iwashima (2): af_unix: Fix data races around sk->sk_shutdown. af_unix: Fix data-races around sk->sk_shutdown. net/core/sock.c | 4 ++-- net/unix/af_unix.c | 22 +++++++++++++--------- 2 files changed, 15 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
by Liu Jian 22 Jun '24

22 Jun '24

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v5.10.219 commit 4d51845d734a4c5d079e56e0916f936a55e15055 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SCO CVE: CVE-2024-38596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ] A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writes to sk->sk_shutdown using WRITE_ONCE. However, on the reader side, unix_stream_sendmsg() does not read it atomically. Consequently, this issue is causing the following KCSAN splat to occur: BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: unix_release_sock (net/unix/af_unix.c:640) unix_release (net/unix/af_unix.c:1050) sock_close (net/socket.c:659 net/socket.c:1421) __fput (fs/file_table.c:422) __fput_sync (fs/file_table.c:508) __se_sys_close (fs/open.c:1559 fs/open.c:1541) __x64_sys_close (fs/open.c:1541) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: unix_stream_sendmsg (net/unix/af_unix.c:2273) __sock_sendmsg (net/socket.c:730 net/socket.c:745) ____sys_sendmsg (net/socket.c:2584) __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x01 -> 0x03 The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7"). Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") addressed a comparable issue in the past regarding sk->sk_shutdown. However, it overlooked resolving this particular data path. This patch only offending unix_stream_sendmsg() function, since the other reads seem to be protected by unix_state_lock() as discussed in Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@amazon.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@debian.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/unix/af_unix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index e870c835eea8..79c3c6dd30e0 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2028,7 +2028,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, goto out_err; } - if (sk->sk_shutdown & SEND_SHUTDOWN) + if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) goto pipe_err; while (sent < len) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
by Liu Jian 22 Jun '24

22 Jun '24

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v4.19.316 commit fca6072e1a7b1e709ada5604b951513b89b4bd0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SCO CVE: CVE-2024-38596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ] A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writes to sk->sk_shutdown using WRITE_ONCE. However, on the reader side, unix_stream_sendmsg() does not read it atomically. Consequently, this issue is causing the following KCSAN splat to occur: BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: unix_release_sock (net/unix/af_unix.c:640) unix_release (net/unix/af_unix.c:1050) sock_close (net/socket.c:659 net/socket.c:1421) __fput (fs/file_table.c:422) __fput_sync (fs/file_table.c:508) __se_sys_close (fs/open.c:1559 fs/open.c:1541) __x64_sys_close (fs/open.c:1541) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: unix_stream_sendmsg (net/unix/af_unix.c:2273) __sock_sendmsg (net/socket.c:730 net/socket.c:745) ____sys_sendmsg (net/socket.c:2584) __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x01 -> 0x03 The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7"). Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") addressed a comparable issue in the past regarding sk->sk_shutdown. However, it overlooked resolving this particular data path. This patch only offending unix_stream_sendmsg() function, since the other reads seem to be protected by unix_state_lock() as discussed in Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@amazon.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@debian.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/unix/af_unix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index da7ad1bf5ada..5484083cfd68 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1895,7 +1895,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, goto out_err; } - if (sk->sk_shutdown & SEND_SHUTDOWN) + if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) goto pipe_err; while (sent < len) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] firmware: arm_scpi: Fix string overflow in SCPI genpd driver
by Yi Yang 22 Jun '24

22 Jun '24

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.222 commit 7e8645ca2c0046f7cd2f0f7d569fc036c8abaedb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SID Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 865ed67ab955428b9aa771d8b4f1e4fb7fd08945 upstream. Without the bound checks for scpi_pd->name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name string is set at maximum size of 30. Let us fix it by using devm_kasprintf so that the string buffer is allocated dynamically. Fixes: 8bec4337ad40 ("firmware: scpi: add device power domain support using genpd") Reported-by: Pedro Batista <pedbap.g(a)gmail.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Cc: stable(a)vger.kernel.org Cc: Cristian Marussi <cristian.marussi(a)arm.com> Link: https://lore.kernel.org/r/20211209120456.696879-1-sudeep.holla@arm.com' Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/firmware/scpi_pm_domain.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/scpi_pm_domain.c b/drivers/firmware/scpi_pm_domain.c index f395dec27113..a6e62a793fbe 100644 --- a/drivers/firmware/scpi_pm_domain.c +++ b/drivers/firmware/scpi_pm_domain.c @@ -27,7 +27,6 @@ struct scpi_pm_domain { struct generic_pm_domain genpd; struct scpi_ops *ops; u32 domain; - char name[30]; }; /* @@ -121,8 +120,13 @@ static int scpi_pm_domain_probe(struct platform_device *pdev) scpi_pd->domain = i; scpi_pd->ops = scpi_ops; - sprintf(scpi_pd->name, "%s.%d", np->name, i); - scpi_pd->genpd.name = scpi_pd->name; + scpi_pd->genpd.name = devm_kasprintf(dev, GFP_KERNEL, + "%s.%d", np->name, i); + if (!scpi_pd->genpd.name) { + dev_err(dev, "Failed to allocate genpd name:%s.%d\n", + np->name, i); + continue; + } scpi_pd->genpd.power_off = scpi_pd_power_off; scpi_pd->genpd.power_on = scpi_pd_power_on; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 15565/23022] arch/x86/kvm/svm.c:1903 sev_vm_destroy() warn: inconsistent indenting
by kernel test robot 22 Jun '24

22 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3441ff8f5dfa49d91987c2ef11a2d1647a0d56ff commit: 457eaaadf6723ca66af506471c5209bb4983f87d [15565/23022] KVM: SVM: Periodically schedule when unregistering regions on destroy config: x86_64-randconfig-161-20240622 (https://download.01.org/0day-ci/archive/20240622/202406221300.KSmWRO3o-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406221300.KSmWRO3o-lkp@intel.com/ smatch warnings: arch/x86/kvm/svm.c:1903 sev_vm_destroy() warn: inconsistent indenting vim +1903 arch/x86/kvm/svm.c 1883 1884 static void sev_vm_destroy(struct kvm *kvm) 1885 { 1886 struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; 1887 struct list_head *head = &sev->regions_list; 1888 struct list_head *pos, *q; 1889 1890 if (!sev_guest(kvm)) 1891 return; 1892 1893 mutex_lock(&kvm->lock); 1894 1895 /* 1896 * if userspace was terminated before unregistering the memory regions 1897 * then lets unpin all the registered memory. 1898 */ 1899 if (!list_empty(head)) { 1900 list_for_each_safe(pos, q, head) { 1901 __unregister_enc_region_locked(kvm, 1902 list_entry(pos, struct enc_region, list)); > 1903 cond_resched(); 1904 } 1905 } 1906 1907 mutex_unlock(&kvm->lock); 1908 1909 sev_unbind_asid(kvm, sev->handle); 1910 sev_asid_free(kvm); 1911 } 1912 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v2 0/5] Linux 4.19.312-313 LTS patches
by Liu Jian 22 Jun '24

22 Jun '24

some network LTS patches Dai Ngo (1): SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int Daniel Borkmann (1): vxlan: Fix regression when dropping packets due to invalid src addresses David Bauer (1): vxlan: drop packets from invalid src-address Jiri Benc (1): ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Yick Xie (1): udp: preserve the connected status if only UDP cmsg drivers/net/vxlan.c | 4 ++++ include/linux/sunrpc/sched.h | 2 +- include/net/addrconf.h | 4 ++++ net/ipv4/udp.c | 5 +++-- net/ipv6/addrconf.c | 7 ++++--- net/ipv6/udp.c | 5 +++-- 6 files changed, 19 insertions(+), 8 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0-LTS 0/4] Linux 4.19.312-313 LTS patches
by Liu Jian 22 Jun '24

22 Jun '24

some network LTS patches. Dai Ngo (1): SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int David Bauer (1): vxlan: drop packets from invalid src-address Jiri Benc (1): ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Yick Xie (1): udp: preserve the connected status if only UDP cmsg drivers/net/vxlan.c | 4 ++++ include/linux/sunrpc/sched.h | 2 +- include/net/addrconf.h | 4 ++++ net/ipv4/udp.c | 5 +++-- net/ipv6/addrconf.c | 7 ++++--- net/ipv6/udp.c | 5 +++-- 6 files changed, 19 insertions(+), 8 deletions(-) -- 2.34.1

2 5