- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19] arm64/mpam: fix a memleak in add_schema
by Zhang ming 18 Mar '21

18 Mar '21

From: Zhang Ming <154842638(a)qq.com> openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3BPPX CVE: NA ----------------------------------------------------------- The default branch in switch will not run at present, but there may be related extensions in the future, which may lead to memory leakage Signed-off-by: Zhang Ming <154842638(a)qq.com> Reported-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Suggested-by: Jian Cheng <cj.chengjian(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index aae585e7d7df..a4a298a455e0 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -78,6 +78,7 @@ static int add_schema(enum resctrl_conf_type t, struct resctrl_resource *r) suffix = ""; break; default: + kfree(s); return -EINVAL; } -- 2.17.1

3 2

[PATCH openEuler-21.03] arm64/mpam: fix a memleak in add_schema
by Zhang ming 18 Mar '21

18 Mar '21

From: Zhang Ming <154842638(a)qq.com> openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3BPPX CVE: NA --------------------------------------- -------------------- The default branch in switch will not run at present, but there may be related extensions in the future, which may lead to memory leakage Signed-off-by: Zhang Ming <154842638(a)qq.com> Reported-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Suggested-by: Jian Cheng <cj.chengjian(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 4acf9234c3a5..b1d32d432556 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -74,6 +74,7 @@ static int add_schema(enum resctrl_conf_type t, struct resctrl_resource *r) suffix = ""; break; default: + kfree(s); return -EINVAL; } -- 2.17.1

3 2

[PATCH v1 openEuler-21.03] fix a bug of memory leakage of openEuler-21.03
by Zhang ming 17 Mar '21

17 Mar '21

From: Zhang Ming <154842638(a)qq.com> [PATCH v1 openEuler-21.03]arch/arm64/kernel/mpam/mpam_ctrlmon.c: fix a bug of memory leakage openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3BPPX CVE: NA ----------------------------------------------------------- The default branch in switch will not run at present, but there may be related extensions in the future, which may lead to memory leakage Signed-off-by: Zhang Ming <154842638(a)qq.com> Reported-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Suggested-by: Jian Cheng <cj.chengjian(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 4acf9234c3a5..b1d32d432556 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -74,6 +74,7 @@ static int add_schema(enum resctrl_conf_type t, struct resctrl_resource *r) suffix = ""; break; default: + kfree(s); return -EINVAL; } -- 2.17.1

1 0

[PATCH v1 kernel-4.19] fix a bug of memory leakage
by Zhang ming 17 Mar '21

17 Mar '21

From: Zhang Ming <154842638(a)qq.com> [PATCH kernel-4.19]arch/arm64/kernel/mpam/mpam_ctrlmon.c: fix a bug of memory leakage openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3BPPX CVE: NA ----------------------------------------------------------- The default branch in switch will not run at present, but there may be related extensions in the future, which may lead to memory leakage Signed-off-by: Zhang Ming <154842638(a)qq.com> Reported-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Suggested-by: Jian Cheng <cj.chengjian(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index aae585e7d7df..a4a298a455e0 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -78,6 +78,7 @@ static int add_schema(enum resctrl_conf_type t, struct resctrl_resource *r) suffix = ""; break; default: + kfree(s); return -EINVAL; } -- 2.17.1

1 0

openEuler kernel sig meeting
by openEuler conference 17 Mar '21

17 Mar '21

1 0

[PATCH openEuler-20.09 00/23] CVE for openEuler 20.09
by Cheng Jian 16 Mar '21

16 Mar '21

CVE for openEuler 20.09 Chris Leech (2): scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE scsi: iscsi: Verify lengths on passthrough PDUs Jan Beulich (10): Xen/x86: don't bail early from clear_foreign_p2m_mapping() Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() Xen/gntdev: correct error checking in gntdev_map_grant_pages() xen-blkback: don't "handle" error by BUG() xen-netback: don't "handle" error by BUG() xen-scsiback: don't "handle" error by BUG() xen-blkback: fix error handling in xen_blkbk_map() Xen/gnttab: handle p2m update errors on a per-slot basis xen-netback: respect gnttab_map_refs()'s return value Joe Perches (1): sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output Lee Duncan (1): scsi: iscsi: Restrict sessions and handles to admin capabilities Miklos Szeredi (6): ovl: pass correct flags for opening real directory ovl: switch to mounter creds in readdir ovl: verify permissions in ovl_path_open() ovl: call secutiry hook in ovl_real_ioctl() ovl: check permission to open real file ovl: do not fail because of O_NOATIME Stefano Stabellini (1): xen/arm: don't ignore return errors from set_phys_to_machine Wenchao Hao (1): virtio-blk: modernize sysfs attribute creation Yang Yingliang (1): sysfs: fix kabi broken when add sysfs_emit and sysfs_emit_at Documentation/filesystems/sysfs.txt | 8 +- arch/arm/xen/p2m.c | 33 ++++++- arch/x86/xen/p2m.c | 59 ++++++++--- drivers/block/virtio_blk.c | 67 +++++++------ drivers/block/xen-blkback/blkback.c | 30 +++--- drivers/net/xen-netback/netback.c | 10 +- drivers/scsi/libiscsi.c | 148 ++++++++++++++-------------- drivers/scsi/scsi_transport_iscsi.c | 38 +++++-- drivers/xen/gntdev.c | 37 +++---- drivers/xen/xen-scsiback.c | 4 +- fs/overlayfs/file.c | 28 ++++-- fs/overlayfs/readdir.c | 37 +++++-- fs/overlayfs/util.c | 27 ++++- fs/sysfs/file.c | 55 +++++++++++ include/linux/sysfs.h | 16 +++ include/xen/grant_table.h | 1 + security/security.c | 1 + 17 files changed, 419 insertions(+), 180 deletions(-) -- 2.25.1

2 24

[PATCH openEuler-1.0-LTS 00/32] CVE in March for 20.03
by Cheng Jian 15 Mar '21

15 Mar '21

CVE-2021-27365 CVE-2021-27363 CVE-2021-27364 Chris Leech (2): scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE scsi: iscsi: Verify lengths on passthrough PDUs Christoph Hellwig (1): mm/swapfile.c: fix a comment in sys_swapon() Darrick J. Wong (2): mm: set S_SWAPFILE on blockdev swap devices vfs: don't allow writes to swap files Domenico Andreoli (1): hibernate: Allow uswsusp to write to swap Jan Beulich (10): Xen/x86: don't bail early from clear_foreign_p2m_mapping() Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() Xen/gntdev: correct error checking in gntdev_map_grant_pages() xen-blkback: don't "handle" error by BUG() xen-netback: don't "handle" error by BUG() xen-scsiback: don't "handle" error by BUG() xen-blkback: fix error handling in xen_blkbk_map() Xen/gnttab: handle p2m update errors on a per-slot basis xen-netback: respect gnttab_map_refs()'s return value Joe Perches (1): sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output Lee Duncan (1): scsi: iscsi: Restrict sessions and handles to admin capabilities Miaohe Lin (1): mm/swapfile.c: fix potential memory leak in sys_swapon Miklos Szeredi (6): ovl: pass correct flags for opening real directory ovl: switch to mounter creds in readdir ovl: verify permissions in ovl_path_open() ovl: call secutiry hook in ovl_real_ioctl() ovl: check permission to open real file ovl: do not fail because of O_NOATIME Naohiro Aota (1): mm/swapfile.c: move inode_lock out of claim_swapfile Stefano Stabellini (1): xen/arm: don't ignore return errors from set_phys_to_machine Wenchao Hao (2): nvme: register ns_id attributes as default sysfs groups virtio-blk: modernize sysfs attribute creation Yang Yingliang (1): sysfs: fix kabi broken when add sysfs_emit and sysfs_emit_at Ye Bin (1): ext4: Fix not report exception message when mount with errors=continue zhangyi (F) (1): block_dump: remove block_dump feature when dirting inode Documentation/filesystems/sysfs.txt | 8 +- arch/arm/xen/p2m.c | 33 ++++++- arch/x86/xen/p2m.c | 59 ++++++++--- drivers/block/virtio_blk.c | 67 +++++++------ drivers/block/xen-blkback/blkback.c | 30 +++--- drivers/net/xen-netback/netback.c | 10 +- drivers/nvme/host/core.c | 20 ++-- drivers/nvme/host/lightnvm.c | 105 +++++++++----------- drivers/nvme/host/multipath.c | 11 +-- drivers/nvme/host/nvme.h | 10 +- drivers/scsi/libiscsi.c | 148 ++++++++++++++-------------- drivers/scsi/scsi_transport_iscsi.c | 38 +++++-- drivers/xen/gntdev.c | 37 +++---- drivers/xen/xen-scsiback.c | 4 +- fs/block_dev.c | 5 + fs/ext4/super.c | 6 +- fs/fs-writeback.c | 25 ----- fs/overlayfs/file.c | 28 ++++-- fs/overlayfs/readdir.c | 37 +++++-- fs/overlayfs/util.c | 27 ++++- fs/sysfs/file.c | 55 +++++++++++ include/linux/fs.h | 11 +++ include/linux/sysfs.h | 16 +++ include/xen/grant_table.h | 1 + mm/filemap.c | 3 + mm/memory.c | 4 + mm/mmap.c | 8 +- mm/swapfile.c | 72 ++++++++------ security/security.c | 1 + 29 files changed, 552 insertions(+), 327 deletions(-) -- 2.25.1

1 32

[PATCH openEuler-21.03 v1] arm64: Uninstall cpu park after cpu up
by sangyan＠huawei.com 12 Mar '21

12 Mar '21

From: Sang Yan <sangyan(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ One cpu in PARK state could not come up in this case: CPU 0 | CPU 1 boot_secondary(cpu 1) | --> write_park_exit(cpu 1) | | cpu uping from PARK | ... uninstall_cpu_park() | --> memset to 0 park text | | ... | Exception in memory !! wait for cpu up | Cpu 1 uping from PARK may trap into exception while cpu 0 clear cpu 1's park text memory. This uninstall_cpu_park should be after waiting for cpu up. Signed-off-by: Sang Yan <sangyan(a)huawei.com> --- arch/arm64/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index d7b750a..fb6007d 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -300,15 +300,15 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) return ret; } -#ifdef CONFIG_ARM64_CPU_PARK - uninstall_cpu_park(cpu); -#endif /* * CPU was successfully started, wait for it to come online or * time out. */ wait_for_completion_timeout(&cpu_running, msecs_to_jiffies(5000)); +#ifdef CONFIG_ARM64_CPU_PARK + uninstall_cpu_park(cpu); +#endif if (cpu_online(cpu)) return 0; -- 2.9.5

2 1

[PATCH OLK-5.10 v1] arm64: Uninstall cpu park after cpu up
by sangyan＠huawei.com 12 Mar '21

12 Mar '21

From: Sang Yan <sangyan(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ One cpu in PARK state could not come up in this case: CPU 0 | CPU 1 boot_secondary(cpu 1) | --> write_park_exit(cpu 1) | | cpu uping from PARK | ... uninstall_cpu_park() | --> memset to 0 park text | | ... | Exception in memory !! wait for cpu up | Cpu 1 uping from PARK may trap into exception while cpu 0 clear cpu 1's park text memory. This uninstall_cpu_park should be after waiting for cpu up. Signed-off-by: Sang Yan <sangyan(a)huawei.com> --- arch/arm64/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index d7b750a..fb6007d 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -300,15 +300,15 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) return ret; } -#ifdef CONFIG_ARM64_CPU_PARK - uninstall_cpu_park(cpu); -#endif /* * CPU was successfully started, wait for it to come online or * time out. */ wait_for_completion_timeout(&cpu_running, msecs_to_jiffies(5000)); +#ifdef CONFIG_ARM64_CPU_PARK + uninstall_cpu_park(cpu); +#endif if (cpu_online(cpu)) return 0; -- 2.9.5

1 0

[PATCH openEuler-21.03 v2] park: Reserve park mem before kexec reserved
by sangyan＠huawei.com 12 Mar '21

12 Mar '21

From: Sang Yan <sangyan(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ reserve_crashkernel or reserve_quick_kexec may find one sutiable memory region and reserves it, which address of the region is not fixed. As a result, cpu park reserves memory could be failed while specified address used by crashkernel or quickkexec. So, move reserve_park_mem before reserve_crashkernel and reserve_quick_kexec. Signed-off-by: Sang Yan <sangyan(a)huawei.com> Reviewed-by: Jing Xiangfeng <jingxiangfeng(a)huawei.com> --- arch/arm64/mm/init.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index b343744..dbcc801 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -497,16 +497,25 @@ void __init arm64_memblock_init(void) else arm64_dma32_phys_limit = PHYS_MASK + 1; + /* + * Reserve park memory before crashkernel and quick kexec. + * Because park memory must be specified by address, but + * crashkernel and quickkexec may be specified by memory length, + * then find one sutiable memory region to reserve. + * + * So reserve park memory firstly is better, but it may cause + * crashkernel or quickkexec reserving failed. + */ +#ifdef CONFIG_ARM64_CPU_PARK + reserve_park_mem(); +#endif + reserve_crashkernel(); #ifdef CONFIG_QUICK_KEXEC reserve_quick_kexec(); #endif -#ifdef CONFIG_ARM64_CPU_PARK - reserve_park_mem(); -#endif - reserve_pin_memory_res(); reserve_elfcorehdr(); -- 2.9.5

1 0