- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/2] nbd: Fix memory leak in nbd_add_socket
by Yang Yingliang 07 Feb '21

07 Feb '21

From: Zheng Bin <zhengbin13(a)huawei.com> stable inclusion from linux-4.19.133 commit 306290bad932950adccfbf99c27b70c105c2c183 -------------------------------- [ Upstream commit 579dd91ab3a5446b148e7f179b6596b270dace46 ] When adding first socket to nbd, if nsock's allocation failed, the data structure member "config->socks" was reallocated, but the data structure member "config->num_connections" was not updated. A memory leak will occur then because the function "nbd_config_put" will free "config->socks" only when "config->num_connections" is not zero. Fixes: 03bf73c315ed ("nbd: prevent memory leak") Reported-by: syzbot+934037347002901b8d2a(a)syzkaller.appspotmail.com Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 49f98b9b2777..97fcb040056c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -993,25 +993,26 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, test_bit(NBD_RT_BOUND, &config->runtime_flags))) { dev_err(disk_to_dev(nbd->disk), "Device being setup by another task"); - sockfd_put(sock); - return -EBUSY; + err = -EBUSY; + goto put_socket; + } + + nsock = kzalloc(sizeof(*nsock), GFP_KERNEL); + if (!nsock) { + err = -ENOMEM; + goto put_socket; } socks = krealloc(config->socks, (config->num_connections + 1) * sizeof(struct nbd_sock *), GFP_KERNEL); if (!socks) { - sockfd_put(sock); - return -ENOMEM; + kfree(nsock); + err = -ENOMEM; + goto put_socket; } config->socks = socks; - nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); - if (!nsock) { - sockfd_put(sock); - return -ENOMEM; - } - nsock->fallback_index = -1; nsock->dead = false; mutex_init(&nsock->tx_lock); @@ -1023,6 +1024,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, atomic_inc(&config->live_connections); return 0; + +put_socket: + sockfd_put(sock); + return err; } static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/7] futex: Ensure the correct return value from futex_lock_pi()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from linux-4.19.172 commit 72f38fffa4758b878f819f8a47761b3f03443f36 CVE: CVE-2021-3347 -------------------------------- commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream In case that futex_lock_pi() was aborted by a signal or a timeout and the task returned without acquiring the rtmutex, but is the designated owner of the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to establish consistent state. In that case it invokes fixup_pi_state_owner() which in turn tries to acquire the rtmutex again. If that succeeds then it does not propagate this success to fixup_owner() and futex_lock_pi() returns -EINTR or -ETIMEOUT despite having the futex locked. Return success from fixup_pi_state_owner() in all cases where the current task owns the rtmutex and therefore the futex and propagate it correctly through fixup_owner(). Fixup the other callsite which does not expect a positive return value. Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/futex.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index 28b321e23053..ca9389bd110f 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -2414,8 +2414,8 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, } if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) { - /* We got the lock after all, nothing to fix. */ - ret = 0; + /* We got the lock. pi_state is correct. Tell caller. */ + ret = 1; goto out_unlock; } @@ -2431,7 +2431,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * We raced against a concurrent self; things are * already fixed up. Nothing to do. */ - ret = 0; + ret = 1; goto out_unlock; } newowner = argowner; @@ -2477,7 +2477,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, raw_spin_unlock(&newowner->pi_lock); raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); - return 0; + return argowner == current; /* * In order to reschedule or handle a page fault, we need to drop the @@ -2519,7 +2519,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * Check if someone else fixed it for us: */ if (pi_state->owner != oldowner) { - ret = 0; + ret = argowner == current; goto out_unlock; } @@ -2552,8 +2552,6 @@ static long futex_wait_restart(struct restart_block *restart); */ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) { - int ret = 0; - if (locked) { /* * Got the lock. We might not be the anticipated owner if we @@ -2564,8 +2562,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * stable state, anything else needs more attention. */ if (q->pi_state->owner != current) - ret = fixup_pi_state_owner(uaddr, q, current); - goto out; + return fixup_pi_state_owner(uaddr, q, current); + return 1; } /* @@ -2576,10 +2574,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * Another speculative read; pi_state->owner == current is unstable * but needs our attention. */ - if (q->pi_state->owner == current) { - ret = fixup_pi_state_owner(uaddr, q, NULL); - goto out; - } + if (q->pi_state->owner == current) + return fixup_pi_state_owner(uaddr, q, NULL); /* * Paranoia check. If we did not take the lock, then we should not be @@ -2592,8 +2588,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) q->pi_state->owner); } -out: - return ret ? ret : locked; + return 0; } /** @@ -3315,7 +3310,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, if (q.pi_state && (q.pi_state->owner != current)) { spin_lock(q.lock_ptr); ret = fixup_pi_state_owner(uaddr2, &q, current); - if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { + if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { pi_state = q.pi_state; get_pi_state(pi_state); } @@ -3325,6 +3320,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, */ put_pi_state(q.pi_state); spin_unlock(q.lock_ptr); + /* + * Adjust the return value. It's either -EFAULT or + * success (1) but the caller expects 0 for success. + */ + ret = ret < 0 ? ret : 0; } } else { struct rt_mutex *pi_mutex; -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 1/3] netfilter: clear skb->next in NF_HOOK_LIST()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Cong Wang <cong.wang(a)bytedance.com> stable inclusion from linux-4.19.161 commit 5460d62d661c0fc53bfe83493821b1dc3dc969f4 -------------------------------- NF_HOOK_LIST() uses list_del() to remove skb from the linked list, however, it is not sufficient as skb->next still points to other skb. We should just call skb_list_del_init() to clear skb->next, like the rest places which using skb list. This has been fixed in upstream by commit ca58fbe06c54 ("netfilter: add and use nf_hook_slow_list()"). Fixes: 9f17dbf04ddf ("netfilter: fix use-after-free in NF_HOOK_LIST") Reported-by: liuzx(a)knownsec.com Tested-by: liuzx(a)knownsec.com Cc: Florian Westphal <fw(a)strlen.de> Cc: Edward Cree <ecree(a)solarflare.com> Cc: stable(a)vger.kernel.org # between 4.19 and 5.4 Signed-off-by: Cong Wang <cong.wang(a)bytedance.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/netfilter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 72cb19c3db6a..9460a5635c90 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -300,7 +300,7 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, INIT_LIST_HEAD(&sublist); list_for_each_entry_safe(skb, next, head, list) { - list_del(&skb->list); + skb_list_del_init(skb); if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) list_add_tail(&skb->list, &sublist); } -- 2.25.1

1 2

[PATCH kernel-4.19 1/4] arm64: module: rework special section handling
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.5-rc1 commit bd8b21d3dd661658addc1cd4cc869bab11d28596 category: bugfix bugzilla: 25285 CVE: NA -------------------------------- When we load a module, we have to perform some special work for a couple of named sections. To do this, we iterate over all of the module's sections, and perform work for each section we recognize. To make it easier to handle the unexpected absence of a section, and to make the section-specific logic easer to read, let's factor the section search into a helper. Similar is already done in the core module loader, and other architectures (and ideally we'd unify these in future). If we expect a module to have an ftrace trampoline section, but it doesn't have one, we'll now reject loading the module. When ARM64_MODULE_PLTS is selected, any correctly built module should have one (and this is assumed by arm64's ftrace PLT code) and the absence of such a section implies something has gone wrong at build time. Subsequent patches will make use of the new helper. Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Reviewed-by: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Reviewed-by: Torsten Duwe <duwe(a)suse.de> Tested-by: Amit Daniel Kachhap <amit.kachhap(a)arm.com> Tested-by: Torsten Duwe <duwe(a)suse.de> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: James Morse <james.morse(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/module.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c index 834ecf108b53..55b00bfb704f 100644 --- a/arch/arm64/kernel/module.c +++ b/arch/arm64/kernel/module.c @@ -484,22 +484,39 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, return -ENOEXEC; } -int module_finalize(const Elf_Ehdr *hdr, - const Elf_Shdr *sechdrs, - struct module *me) +static const Elf_Shdr *find_section(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + const char *name) { const Elf_Shdr *s, *se; const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) { - if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) - apply_alternatives_module((void *)s->sh_addr, s->sh_size); + if (strcmp(name, secstrs + s->sh_name) == 0) + return s; + } + + return NULL; +} + +int module_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + struct module *me) +{ + const Elf_Shdr *s; + + s = find_section(hdr, sechdrs, ".altinstructions"); + if (s) + apply_alternatives_module((void *)s->sh_addr, s->sh_size); + #ifdef CONFIG_ARM64_MODULE_PLTS - if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) && - !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name)) - me->arch.ftrace_trampoline = (void *)s->sh_addr; -#endif + if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE)) { + s = find_section(hdr, sechdrs, ".text.ftrace_trampoline"); + if (!s) + return -ENOEXEC; + me->arch.ftrace_trampoline = (void *)s->sh_addr; } +#endif return 0; } -- 2.25.1

1 3

[PATCH kernel-4.19 00/27] backport stable-4.19.172
by Yang Yingliang 04 Feb '21

04 Feb '21

Baruch Siach (1): gpio: mvebu: fix pwm .get_state period calculation Eric Biggers (1): fs: fix lazytime expiration handling in __writeback_single_inode() Gaurav Kohli (1): tracing: Fix race in trace_open and buffer resize call Greg Kroah-Hartman (1): Linux 4.19.172 Jan Kara (1): writeback: Drop I_DIRTY_TIME_EXPIRE Jason Gerecke (1): HID: wacom: Correct NULL dereference on AES pen proximity Jean-Philippe Brucker (1): tools: Factor HOSTCC, HOSTLD, HOSTAR definitions Mikulas Patocka (1): dm integrity: conditionally disable "recalculate" feature Thomas Gleixner (18): futex: Move futex exit handling into futex code futex: Replace PF_EXITPIDONE with a state exit/exec: Seperate mm_release() futex: Split futex_mm_release() for exit/exec futex: Set task::futex_state to DEAD right after handling futex exit futex: Mark the begin of futex exit explicitly futex: Sanitize exit state handling futex: Provide state handling for exec() as well futex: Add mutex around futex exit futex: Provide distinct return value when owner is exiting futex: Prevent exit livelock futex: Ensure the correct return value from futex_lock_pi() futex: Replace pointless printk in fixup_owner() futex: Provide and use pi_state_update_owner() rtmutex: Remove unused argument from rt_mutex_proxy_unlock() futex: Use pi_state_update_owner() in put_pi_state() futex: Simplify fixup_pi_state_owner() futex: Handle faults correctly for PI futexes Wang Hai (1): Revert "mm/slub: fix a memory leak in sysfs_slab_add()" Documentation/device-mapper/dm-integrity.txt | 7 + Makefile | 2 +- drivers/gpio/gpio-mvebu.c | 25 +- drivers/hid/wacom_sys.c | 7 +- drivers/hid/wacom_wac.h | 2 +- drivers/md/dm-integrity.c | 24 +- fs/exec.c | 2 +- fs/ext4/inode.c | 2 +- fs/fs-writeback.c | 36 +- fs/xfs/xfs_trans_inode.c | 4 +- include/linux/compat.h | 2 - include/linux/fs.h | 1 - include/linux/futex.h | 40 +- include/linux/sched.h | 3 +- include/linux/sched/mm.h | 6 +- include/trace/events/writeback.h | 1 - kernel/exit.c | 30 +- kernel/fork.c | 40 +- kernel/futex.c | 485 +++++++++++++------ kernel/locking/rtmutex.c | 3 +- kernel/locking/rtmutex_common.h | 3 +- kernel/trace/ring_buffer.c | 4 + mm/slub.c | 4 +- tools/build/Makefile | 4 - tools/objtool/Makefile | 9 - tools/perf/Makefile.perf | 4 - tools/power/acpi/Makefile.config | 1 - tools/scripts/Makefile.include | 10 + 28 files changed, 459 insertions(+), 302 deletions(-) -- 2.25.1

1 27

[PATCH kernel-4.19 1/2] netfilter: add and use nf_hook_slow_list()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v5.5-rc1 commit ca58fbe06c54795f00db79e447f94c2028d30124 category: bugfix bugzilla: NA CVE: CVE-2021-20177 -------------------------------- At this time, NF_HOOK_LIST() macro will iterate the list and then calls nf_hook() for each individual skb. This makes it so the entire list is passed into the netfilter core. The advantage is that we only need to fetch the rule blob once per list instead of per-skb. NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only callers. v2: use skb_list_del_init() instead of list_del (Edward Cree) Signed-off-by: Florian Westphal <fw(a)strlen.de> Acked-by: Edward Cree <ecree(a)solarflare.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/linux/netfilter.h net/netfilter/core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/netfilter.h | 41 +++++++++++++++++++++++++++++---------- net/netfilter/core.c | 20 +++++++++++++++++++ 2 files changed, 51 insertions(+), 10 deletions(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 9460a5635c90..8bf57abee9e4 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -183,6 +183,8 @@ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, const struct nf_hook_entries *e, unsigned int i); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e); /** * nf_hook - call a netfilter hook * @@ -295,17 +297,36 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct list_head *head, struct net_device *in, struct net_device *out, int (*okfn)(struct net *, struct sock *, struct sk_buff *)) { - struct sk_buff *skb, *next; - struct list_head sublist; - - INIT_LIST_HEAD(&sublist); - list_for_each_entry_safe(skb, next, head, list) { - skb_list_del_init(skb); - if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) - list_add_tail(&skb->list, &sublist); + struct nf_hook_entries *hook_head = NULL; + +#ifdef CONFIG_JUMP_LABEL + if (__builtin_constant_p(pf) && + __builtin_constant_p(hook) && + !static_key_false(&nf_hooks_needed[pf][hook])) + return; +#endif + + rcu_read_lock(); + switch (pf) { + case NFPROTO_IPV4: + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]); + break; + case NFPROTO_IPV6: + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]); + break; + default: + WARN_ON_ONCE(1); + break; } - /* Put passed packets back on main list */ - list_splice(&sublist, head); + + if (hook_head) { + struct nf_hook_state state; + + nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn); + + nf_hook_slow_list(head, &state, hook_head); + } + rcu_read_unlock(); } /* Call setsockopt() */ diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 93aaec3a54ec..3f0bdc728f89 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -536,6 +536,26 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, EXPORT_SYMBOL(nf_hook_slow); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e) +{ + struct sk_buff *skb, *next; + struct list_head sublist; + int ret; + + INIT_LIST_HEAD(&sublist); + + list_for_each_entry_safe(skb, next, head, list) { + skb_list_del_init(skb); + ret = nf_hook_slow(skb, state, e, 0); + if (ret == 1) + list_add_tail(&skb->list, &sublist); + } + /* Put passed packets back on main list */ + list_splice(&sublist, head); +} +EXPORT_SYMBOL(nf_hook_slow_list); + int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) { if (writable_len > skb->len) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] scsi: target: Fix XCOPY NAA identifier lookup
by Yang Yingliang 04 Feb '21

04 Feb '21

From: David Disseldorp <ddiss(a)suse.de> stable inclusion from linux-4.19.167 commit fff1180d24e68d697f98642d71444316036a81ff CVE: CVE-2020-28374 -------------------------------- commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 upstream. When attempting to match EXTENDED COPY CSCD descriptors with corresponding se_devices, target_xcopy_locate_se_dev_e4() currently iterates over LIO's global devices list which includes all configured backstores. This change ensures that only initiator-accessible backstores are considered during CSCD descriptor lookup, according to the session's se_node_acl LUN list. To avoid LUN removal race conditions, device pinning is changed from being configfs based to instead using the se_node_acl lun_ref. Reference: CVE-2020-28374 Fixes: cbf031f425fd ("target: Add support for EXTENDED_COPY copy offload emulation") Reviewed-by: Lee Duncan <lduncan(a)suse.com> Signed-off-by: David Disseldorp <ddiss(a)suse.de> Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/target/target_core_xcopy.c | 119 +++++++++++++++++------------ drivers/target/target_core_xcopy.h | 1 + 2 files changed, 71 insertions(+), 49 deletions(-) diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index 7cdb5d7f6538..1709b8a99bd7 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -55,60 +55,83 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf) return 0; } -struct xcopy_dev_search_info { - const unsigned char *dev_wwn; - struct se_device *found_dev; -}; - +/** + * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers + * + * @se_dev: device being considered for match + * @dev_wwn: XCOPY requested NAA dev_wwn + * @return: 1 on match, 0 on no-match + */ static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev, - void *data) + const unsigned char *dev_wwn) { - struct xcopy_dev_search_info *info = data; unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; int rc; - if (!se_dev->dev_attrib.emulate_3pc) + if (!se_dev->dev_attrib.emulate_3pc) { + pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev); return 0; + } memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN); target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]); - rc = memcmp(&tmp_dev_wwn[0], info->dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN); - if (rc != 0) - return 0; - - info->found_dev = se_dev; - pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev); - - rc = target_depend_item(&se_dev->dev_group.cg_item); + rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN); if (rc != 0) { - pr_err("configfs_depend_item attempt failed: %d for se_dev: %p\n", - rc, se_dev); - return rc; + pr_debug("XCOPY: skip non-matching: %*ph\n", + XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn); + return 0; } + pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev); - pr_debug("Called configfs_depend_item for se_dev: %p se_dev->se_dev_group: %p\n", - se_dev, &se_dev->dev_group); return 1; } -static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn, - struct se_device **found_dev) +static int target_xcopy_locate_se_dev_e4(struct se_session *sess, + const unsigned char *dev_wwn, + struct se_device **_found_dev, + struct percpu_ref **_found_lun_ref) { - struct xcopy_dev_search_info info; - int ret; - - memset(&info, 0, sizeof(info)); - info.dev_wwn = dev_wwn; - - ret = target_for_each_device(target_xcopy_locate_se_dev_e4_iter, &info); - if (ret == 1) { - *found_dev = info.found_dev; - return 0; - } else { - pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n"); - return -EINVAL; + struct se_dev_entry *deve; + struct se_node_acl *nacl; + struct se_lun *this_lun = NULL; + struct se_device *found_dev = NULL; + + /* cmd with NULL sess indicates no associated $FABRIC_MOD */ + if (!sess) + goto err_out; + + pr_debug("XCOPY 0xe4: searching for: %*ph\n", + XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn); + + nacl = sess->se_node_acl; + rcu_read_lock(); + hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) { + struct se_device *this_dev; + int rc; + + this_lun = rcu_dereference(deve->se_lun); + this_dev = rcu_dereference_raw(this_lun->lun_se_dev); + + rc = target_xcopy_locate_se_dev_e4_iter(this_dev, dev_wwn); + if (rc) { + if (percpu_ref_tryget_live(&this_lun->lun_ref)) + found_dev = this_dev; + break; + } } + rcu_read_unlock(); + if (found_dev == NULL) + goto err_out; + + pr_debug("lun_ref held for se_dev: %p se_dev->se_dev_group: %p\n", + found_dev, &found_dev->dev_group); + *_found_dev = found_dev; + *_found_lun_ref = &this_lun->lun_ref; + return 0; +err_out: + pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n"); + return -EINVAL; } static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop, @@ -255,12 +278,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd, switch (xop->op_origin) { case XCOL_SOURCE_RECV_OP: - rc = target_xcopy_locate_se_dev_e4(xop->dst_tid_wwn, - &xop->dst_dev); + rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess, + xop->dst_tid_wwn, + &xop->dst_dev, + &xop->remote_lun_ref); break; case XCOL_DEST_RECV_OP: - rc = target_xcopy_locate_se_dev_e4(xop->src_tid_wwn, - &xop->src_dev); + rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess, + xop->src_tid_wwn, + &xop->src_dev, + &xop->remote_lun_ref); break; default: pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - " @@ -412,18 +439,12 @@ static int xcopy_pt_get_cmd_state(struct se_cmd *se_cmd) static void xcopy_pt_undepend_remotedev(struct xcopy_op *xop) { - struct se_device *remote_dev; - if (xop->op_origin == XCOL_SOURCE_RECV_OP) - remote_dev = xop->dst_dev; + pr_debug("putting dst lun_ref for %p\n", xop->dst_dev); else - remote_dev = xop->src_dev; - - pr_debug("Calling configfs_undepend_item for" - " remote_dev: %p remote_dev->dev_group: %p\n", - remote_dev, &remote_dev->dev_group.cg_item); + pr_debug("putting src lun_ref for %p\n", xop->src_dev); - target_undepend_item(&remote_dev->dev_group.cg_item); + percpu_ref_put(xop->remote_lun_ref); } static void xcopy_pt_release_cmd(struct se_cmd *se_cmd) diff --git a/drivers/target/target_core_xcopy.h b/drivers/target/target_core_xcopy.h index 26ba4c3c9cff..974bc1e19ff2 100644 --- a/drivers/target/target_core_xcopy.h +++ b/drivers/target/target_core_xcopy.h @@ -29,6 +29,7 @@ struct xcopy_op { struct se_device *dst_dev; unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; + struct percpu_ref *remote_lun_ref; sector_t src_lba; sector_t dst_lba; -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] netfilter: add and use nf_hook_slow_list()
by Yang Yingliang 30 Jan '21

30 Jan '21

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v5.5-rc1 commit ca58fbe06c54795f00db79e447f94c2028d30124 category: bugfix bugzilla: NA CVE: CVE-2021-20177 -------------------------------- At this time, NF_HOOK_LIST() macro will iterate the list and then calls nf_hook() for each individual skb. This makes it so the entire list is passed into the netfilter core. The advantage is that we only need to fetch the rule blob once per list instead of per-skb. NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only callers. v2: use skb_list_del_init() instead of list_del (Edward Cree) Signed-off-by: Florian Westphal <fw(a)strlen.de> Acked-by: Edward Cree <ecree(a)solarflare.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/linux/netfilter.h net/netfilter/core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/netfilter.h | 41 +++++++++++++++++++++++++++++---------- net/netfilter/core.c | 20 +++++++++++++++++++ 2 files changed, 51 insertions(+), 10 deletions(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 9460a5635c90..8bf57abee9e4 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -183,6 +183,8 @@ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, const struct nf_hook_entries *e, unsigned int i); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e); /** * nf_hook - call a netfilter hook * @@ -295,17 +297,36 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct list_head *head, struct net_device *in, struct net_device *out, int (*okfn)(struct net *, struct sock *, struct sk_buff *)) { - struct sk_buff *skb, *next; - struct list_head sublist; - - INIT_LIST_HEAD(&sublist); - list_for_each_entry_safe(skb, next, head, list) { - skb_list_del_init(skb); - if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) - list_add_tail(&skb->list, &sublist); + struct nf_hook_entries *hook_head = NULL; + +#ifdef CONFIG_JUMP_LABEL + if (__builtin_constant_p(pf) && + __builtin_constant_p(hook) && + !static_key_false(&nf_hooks_needed[pf][hook])) + return; +#endif + + rcu_read_lock(); + switch (pf) { + case NFPROTO_IPV4: + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]); + break; + case NFPROTO_IPV6: + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]); + break; + default: + WARN_ON_ONCE(1); + break; } - /* Put passed packets back on main list */ - list_splice(&sublist, head); + + if (hook_head) { + struct nf_hook_state state; + + nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn); + + nf_hook_slow_list(head, &state, hook_head); + } + rcu_read_unlock(); } /* Call setsockopt() */ diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 93aaec3a54ec..3f0bdc728f89 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -536,6 +536,26 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, EXPORT_SYMBOL(nf_hook_slow); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e) +{ + struct sk_buff *skb, *next; + struct list_head sublist; + int ret; + + INIT_LIST_HEAD(&sublist); + + list_for_each_entry_safe(skb, next, head, list) { + skb_list_del_init(skb); + ret = nf_hook_slow(skb, state, e, 0); + if (ret == 1) + list_add_tail(&skb->list, &sublist); + } + /* Put passed packets back on main list */ + list_splice(&sublist, head); +} +EXPORT_SYMBOL(nf_hook_slow_list); + int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) { if (writable_len > skb->len) -- 2.25.1

1 1

[PATCH kernel-4.19 00/57] backport stable-4.19.171
by Yang Yingliang 29 Jan '21

29 Jan '21

Alex Leibovich (1): mmc: sdhci-xenon: fix 1.8v regulator stabilization Alexander Lobakin (1): skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too Alexander Shishkin (1): intel_th: pci: Add Alder Lake-P support Arnd Bergmann (1): scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression Ben Skeggs (5): drm/nouveau/bios: fix issue shadowing expansion ROMs drm/nouveau/privring: ack interrupts the same way as RM drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields drm/nouveau/mmu: fix vram heap sizing drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0 Can Guo (1): scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback Cezary Rojewski (1): ASoC: Intel: haswell: Add missing pm_ops Damien Le Moal (1): riscv: Fix kernel time_init() Dan Carpenter (1): net: dsa: b53: fix an off by one in checking "vlan->vid" David Woodhouse (1): xen: Fix event channel callback via INTX/GSI Eric Dumazet (2): net_sched: avoid shift-out-of-bounds in tcindex_set_parms() net_sched: reject silly cell_log in qdisc_get_rtab() Eugene Korenevsky (1): ehci: fix EHCI host controller initialization sequence Geert Uytterhoeven (1): sh_eth: Fix power down vs. is_opened flag ordering Greg Kroah-Hartman (1): Linux 4.19.171 Guillaume Nault (2): netfilter: rpfilter: mask ecn bits before fib lookup udp: mask TOS bits in udp_v4_early_demux() Hangbin Liu (1): selftests: net: fib_tests: remove duplicate log test Hannes Reinecke (1): dm: avoid filesystem lookup in dm_get_dev_t() Hans de Goede (2): ACPI: scan: Make acpi_bus_get_device() clear return pointer on error platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list JC Kuo (1): xhci: tegra: Delay for disabling LFPS detector Josef Bacik (1): btrfs: fix lockdep splat in btrfs_recover_relocation Lars-Peter Clausen (1): iio: ad5504: Fix setting power-down state Lecopzer Chen (2): kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow kasan: fix incorrect arguments passing in kasan_add_zero_shadow Longfang Liu (1): USB: ehci: fix an interrupt calltrace error Mathias Kresin (1): irqchip/mips-cpu: Set IPI domain parent chip Mathias Nyman (1): xhci: make sure TRB is fully written before giving it to the controller Matteo Croce (2): ipv6: create multicast route with RTPROT_KERNEL ipv6: set multicast flag on the multicast route Mikko Perttunen (1): i2c: bpmp-tegra: Ignore unknown I2C_M flags Mikulas Patocka (1): dm integrity: fix a crash if "recalculate" used without "internal_hash" Necip Fazil Yildiran (1): sh: dma: fix kconfig dependency for G2_DMA Nilesh Javali (1): scsi: qedi: Correct max length of CHAP secret Pali Rohár (1): serial: mvebu-uart: fix tx lost characters at power off Pan Bian (1): drm/atomic: put state on error path Patrik Jakobsson (1): usb: bdc: Make bdc pci driver depend on BROKEN Peter Collingbourne (1): mmc: core: don't initialize block size from ext_csd if not present Peter Geis (1): clk: tegra30: Add hda clock default rates to clock driver Rafael J. Wysocki (1): driver core: Extend device_is_dependent() Ryan Chen (1): usb: gadget: aspeed: fix stop dma register setting. Seth Miller (1): HID: Ignore battery for Elan touchscreen on ASUS UX550 Takashi Iwai (2): ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() ALSA: hda/via: Add minimum mute flag Tariq Toukan (1): net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled Thinh Nguyen (1): usb: udc: core: Use lock when write to soft_connect Vincent Mailhol (3): can: dev: can_restart: fix use after free bug can: vxcan: vxcan_xmit: fix use after free bug can: peak_usb: fix use after free bugs Vladimir Oltean (1): net: mscc: ocelot: allow offloading of bridge on top of LAG Wang Hui (1): stm class: Fix module init return on allocation failure Wolfram Sang (1): i2c: octeon: check correct size of maximum RECV_LEN packet Makefile | 2 +- arch/arm/xen/enlighten.c | 2 +- arch/riscv/kernel/time.c | 3 + arch/sh/drivers/dma/Kconfig | 3 +- drivers/acpi/scan.c | 2 + drivers/base/core.c | 17 +++- drivers/clk/tegra/clk-tegra30.c | 2 + drivers/gpu/drm/drm_atomic_helper.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +- drivers/gpu/drm/nouveau/dispnv50/disp.h | 2 +- drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +- .../drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 8 +- .../gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c | 10 ++- .../gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c | 10 ++- .../gpu/drm/nouveau/nvkm/subdev/mmu/base.c | 6 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 + drivers/hwtracing/intel_th/pci.c | 5 ++ drivers/hwtracing/stm/heartbeat.c | 6 +- drivers/i2c/busses/i2c-octeon-core.c | 2 +- drivers/i2c/busses/i2c-tegra-bpmp.c | 2 +- drivers/iio/dac/ad5504.c | 4 +- drivers/irqchip/irq-mips-cpu.c | 7 ++ drivers/md/dm-integrity.c | 6 ++ drivers/md/dm-table.c | 15 +++- drivers/mmc/core/queue.c | 4 +- drivers/mmc/host/sdhci-xenon.c | 7 +- drivers/net/can/dev.c | 4 +- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 +- drivers/net/can/vxcan.c | 6 +- drivers/net/dsa/b53/b53_common.c | 2 +- drivers/net/ethernet/mscc/ocelot.c | 4 +- drivers/net/ethernet/renesas/sh_eth.c | 4 +- drivers/platform/x86/intel-vbtn.c | 6 -- drivers/scsi/megaraid/megaraid_sas_base.c | 6 +- drivers/scsi/qedi/qedi_main.c | 4 +- drivers/scsi/ufs/ufshcd.c | 11 +-- drivers/tty/serial/mvebu-uart.c | 10 ++- drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 +- drivers/usb/gadget/udc/bdc/Kconfig | 2 +- drivers/usb/gadget/udc/core.c | 13 ++- drivers/usb/host/ehci-hcd.c | 12 +++ drivers/usb/host/ehci-hub.c | 3 + drivers/usb/host/xhci-ring.c | 2 + drivers/usb/host/xhci-tegra.c | 7 ++ drivers/xen/events/events_base.c | 10 --- drivers/xen/platform-pci.c | 1 - drivers/xen/xenbus/xenbus.h | 1 + drivers/xen/xenbus/xenbus_comms.c | 8 -- drivers/xen/xenbus/xenbus_probe.c | 81 +++++++++++++++---- fs/btrfs/volumes.c | 2 + include/xen/xenbus.h | 2 +- mm/kasan/kasan_init.c | 23 +++--- net/core/dev.c | 5 ++ net/core/skbuff.c | 6 +- net/ipv4/netfilter/ipt_rpfilter.c | 2 +- net/ipv4/udp.c | 3 +- net/ipv6/addrconf.c | 3 +- net/sched/cls_tcindex.c | 8 +- net/sched/sch_api.c | 3 +- sound/core/seq/oss/seq_oss_synth.c | 3 +- sound/pci/hda/patch_via.c | 1 + sound/soc/intel/boards/haswell.c | 1 + tools/testing/selftests/net/fib_tests.sh | 1 - 65 files changed, 284 insertions(+), 127 deletions(-) -- 2.25.1

1 57

[FAQ] Introduce a JVMTI plug-in fix to openEuler release
by Erik Yuan 28 Jan '21

28 Jan '21

Hi, In Linux 5.8, Nick submitted a patch-set to fix some Errors in symbol search when you try to profile JIT compiled application in OpenJDK with perf. The patchset is: 1e4bd2ae4564 perf jit: Fix inaccurate DWARF line table 7d7e503cac31 perf jvmti: Remove redundant jitdump line table entries 0bdf31811be0 perf jvmti: Fix demangling Java symbols 525c821de0a6 perf tests: Add test for the java demangler 959f8ed4c1a8 perf jvmti: Do not report error when missing debug information 953e92402a52 perf jvmti: Fix jitdump for methods without debug info Because making perf work is very useful for performance analysis on JITed Java application, I'd like to support this patchset in openEuler release. The coming 21.03 should be a first target as that release is upgraded with 5.8+ kernel. Probably we can backport this patchset to 20.03 LTS if needed. To introduce the fix to 21.03, the kernel.spec should be changed with some lines to generate the JVMTI shared library. There are some things I am not sure: 1. kernel.spec is in src-openeuler project, do I submit the change by PR or by sending patch directly to the mailing list? 2. Is there rolling release of openEuler like Tumbleweed? Then we can run some tests with the daily ISO before the stable 21.03 And one more question, has version 21.03 created a build project in openEuler OBS?? Is it this one? https://build.openeuler.org/package/show/openEuler:Mainline/kernel Thanks, Erik

3 5