October 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Maxim Mikityanskiy <maxtram95(a)gmail.com> mainline inclusion from bluetooth-next commit 89f9f3cb86b1c63badaf392a83dd661d56cc50b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7XW CVE: CVE-2022-3564 -------------------------------- Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) -> __sock_queue_rcv_skb. 2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram. An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2cap_reassemble_sdu can't use the SKB after that function returns. However, some places continue accessing struct l2cap_ctrl that resides in the SKB's CB for a short time after l2cap_reassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8). Fix it by keeping a local copy of struct l2cap_ctrl. BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169 Workqueue: hci0 hci_rx_work [bluetooth] Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth ret_from_fork (arch/x86/entry/entry_64.S:306) </TASK> Allocated by task 43169: kasan_save_stack (mm/kasan/common.c:39) __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) __alloc_skb (net/core/skbuff.c:414) l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth process_one_work (kernel/workqueue.c:2289) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:306) Freed by task 27920: kasan_save_stack (mm/kasan/common.c:39) kasan_set_track (mm/kasan/common.c:45) kasan_set_free_info (mm/kasan/generic.c:372) ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328) slab_free_freelist_hook (mm/slub.c:1780) kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553) skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth sock_read_iter (net/socket.c:1087) new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401) vfs_read (fs/read_write.c:482) ksys_read (fs/read_write.c:620) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) Link: https://lore.kernel.org/linux-bluetooth/CAKErNvoqga1WcmoR3-0875esY6TVWFQDan… Fixes: d2a7ac5d5d3a ("Bluetooth: Add the ERTM receive state machine") Fixes: 4b51dae96731 ("Bluetooth: Add streaming mode receive and incoming packet classifier") Signed-off-by: Maxim Mikityanskiy <maxtram95(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> conflicts： net/bluetooth/l2cap_core.c Signed-off-by: Xia Longlong <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/l2cap_core.c | 48 ++++++++++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 38789494867d..436a92e3bf20 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6204,6 +6204,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan, struct l2cap_ctrl *control, struct sk_buff *skb, u8 event) { + struct l2cap_ctrl local_control; int err = 0; bool skb_in_use = false; @@ -6228,15 +6229,32 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan, chan->buffer_seq = chan->expected_tx_seq; skb_in_use = true; + /* l2cap_reassemble_sdu may free skb, hence invalidate + * control, so make a copy in advance to use it after + * l2cap_reassemble_sdu returns and to avoid the race + * condition, for example: + * + * The current thread calls: + * l2cap_reassemble_sdu + * chan->ops->recv == l2cap_sock_recv_cb + * __sock_queue_rcv_skb + * Another thread calls: + * bt_sock_recvmsg + * skb_recv_datagram + * skb_free_datagram + * Then the current thread tries to access control, but + * it was freed by skb_free_datagram. + */ + local_control = *control; err = l2cap_reassemble_sdu(chan, skb, control); if (err) break; - if (control->final) { + if (local_control.final) { if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) { - control->final = 0; - l2cap_retransmit_all(chan, control); + local_control.final = 0; + l2cap_retransmit_all(chan, &local_control); l2cap_ertm_send(chan); } } @@ -6616,11 +6634,27 @@ static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, struct sk_buff *skb) { + /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store + * the txseq field in advance to use it after l2cap_reassemble_sdu + * returns and to avoid the race condition, for example: + * + * The current thread calls: + * l2cap_reassemble_sdu + * chan->ops->recv == l2cap_sock_recv_cb + * __sock_queue_rcv_skb + * Another thread calls: + * bt_sock_recvmsg + * skb_recv_datagram + * skb_free_datagram + * Then the current thread tries to access control, but it was freed by + * skb_free_datagram. + */ + u16 txseq = control->txseq; + BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, chan->rx_state); - if (l2cap_classify_txseq(chan, control->txseq) == - L2CAP_TXSEQ_EXPECTED) { + if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) { l2cap_pass_to_tx(chan, control); BT_DBG("buffer_seq %d->%d", chan->buffer_seq, @@ -6643,8 +6677,8 @@ static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, } } - chan->last_acked_seq = control->txseq; - chan->expected_tx_seq = __next_seq(chan, control->txseq); + chan->last_acked_seq = txseq; + chan->expected_tx_seq = __next_seq(chan, txseq); return 0; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] bnx2x: fix potential memory leak in bnx2x_tpa_stop()
by Yongqiang Liu 24 Oct '22

24 Oct '22

From: Jianglei Nie <niejianglei2021(a)163.com> mainline inclusion from mainline-v6.1-rc1 commit b43f9acbb8942b05252be83ac25a81cec70cc192 category: bugfix bugzilla: 187839, https://gitee.com/src-openeuler/kernel/issues/I5W7B1 CVE: CVE-2022-3542 -------------------------------- bnx2x_tpa_stop() allocates a memory chunk from new_data with bnx2x_frag_alloc(). The new_data should be freed when gets some error. But when "pad + len > fp->rx_buf_size" is true, bnx2x_tpa_stop() returns without releasing the new_data, which will lead to a memory leak. We should free the new_data with bnx2x_frag_free() when "pad + len > fp->rx_buf_size" is true. Fixes: 07b0f00964def8af9321cfd6c4a7e84f6362f728 ("bnx2x: fix possible panic under memory stress") Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index cf01e73d1bcc..a123f1733a59 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -788,6 +788,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, BNX2X_ERR("skb_put is about to fail... pad %d len %d rx_buf_size %d\n", pad, len, fp->rx_buf_size); bnx2x_panic(); + bnx2x_frag_free(fp, new_data); return; } #endif -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] r8152: Rate limit overflow messages
by Yongqiang Liu 21 Oct '22

21 Oct '22

From: Andrew Gaul <gaul(a)gaul.org> mainline inclusion from mainline-v6.1-rc1 commit 93e2be344a7db169b7119de21ac1bf253b8c6907 category: bugfix bugzilla: 187847, https://gitee.com/src-openeuler/kernel/issues/I5WFKR CVE: CVE-2022-3594 -------------------------------- My system shows almost 10 million of these messages over a 24-hour period which pollutes my logs. Signed-off-by: Andrew Gaul <gaul(a)google.com> Link: https://lore.kernel.org/r/20221002034128.2026653-1-gaul@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/usb/r8152.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c index 91d47a714afd..f28fc023c8b7 100644 --- a/drivers/net/usb/r8152.c +++ b/drivers/net/usb/r8152.c @@ -1386,7 +1386,9 @@ static void intr_callback(struct urb *urb) "Stop submitting intr, status %d\n", status); return; case -EOVERFLOW: - netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n"); + if (net_ratelimit()) + netif_info(tp, intr, tp->netdev, + "intr status -EOVERFLOW\n"); goto resubmit; /* -EPIPE: should clear the halt */ default: -- 2.25.1

1 0

openEuler Kernel SIG例会
by openEuler conference 20 Oct '22

20 Oct '22

您好！ Kernel SIG 邀请您参加 2022-10-21 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.22.03-LTS-SP1 支持generic VDPA device介绍； 2.openEuler-22.03-LTS-SP1信息同步； 3.kernel SIG committer推举会议链接：https://us06web.zoom.us/j/85064426665?pwd=cDkyZ25DVDNwZXdJWUx0emVxQWR2QT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-10-21 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.22.03-LTS-SP1 支持generic VDPA device介绍； 2.openEuler-22.03-LTS-SP1信息同步； 3.kernel SIG committer推举 You can join the meeting at https://us06web.zoom.us/j/85064426665?pwd=cDkyZ25DVDNwZXdJWUx0emVxQWR2QT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] tcp/udp: Fix memory leak in ipv6_renew_options().
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.1-rc1 commit 3c52c6bb831f6335c176a0fc7214e26f43adbd11 category: bugfix bugzilla: 187825, https://gitee.com/src-openeuler/kernel/issues/I5VZ0J CVE: CVE-2022-3524 -------------------------------- syzbot reported a memory leak [0] related to IPV6_ADDRFORM. The scenario is that while one thread is converting an IPv6 socket into IPv4 with IPV6_ADDRFORM, another thread calls do_ipv6_setsockopt() and allocates memory to inet6_sk(sk)->XXX after conversion. Then, the converted sk with (tcp|udp)_prot never frees the IPv6 resources, which inet6_destroy_sock() should have cleaned up. setsockopt(IPV6_ADDRFORM) setsockopt(IPV6_DSTOPTS) +-----------------------+ +----------------------+ - do_ipv6_setsockopt(sk, ...) - sockopt_lock_sock(sk) - do_ipv6_setsockopt(sk, ...) - lock_sock(sk) ^._ called via tcpv6_prot - WRITE_ONCE(sk->sk_prot, &tcp_prot) before WRITE_ONCE() - xchg(&np->opt, NULL) - txopt_put(opt) - sockopt_release_sock(sk) - release_sock(sk) - sockopt_lock_sock(sk) - lock_sock(sk) - ipv6_set_opt_hdr(sk, ...) - ipv6_update_options(sk, opt) - xchg(&inet6_sk(sk)->opt, opt) ^._ opt is never freed. - sockopt_release_sock(sk) - release_sock(sk) Since IPV6_DSTOPTS allocates options under lock_sock(), we can avoid this memory leak by testing whether sk_family is changed by IPV6_ADDRFORM after acquiring the lock. This issue exists from the initial commit between IPV6_ADDRFORM and IPV6_PKTOPTIONS. [0]: BUG: memory leak unreferenced object 0xffff888009ab9f80 (size 96): comm "syz-executor583", pid 328, jiffies 4294916198 (age 13.034s) hex dump (first 32 bytes): 01 00 00 00 48 00 00 00 08 00 00 00 00 00 00 00 ....H........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002ee98ae1>] kmalloc include/linux/slab.h:605 [inline] [<000000002ee98ae1>] sock_kmalloc+0xb3/0x100 net/core/sock.c:2566 [<0000000065d7b698>] ipv6_renew_options+0x21e/0x10b0 net/ipv6/exthdrs.c:1318 [<00000000a8c756d7>] ipv6_set_opt_hdr net/ipv6/ipv6_sockglue.c:354 [inline] [<00000000a8c756d7>] do_ipv6_setsockopt.constprop.0+0x28b7/0x4350 net/ipv6/ipv6_sockglue.c:668 [<000000002854d204>] ipv6_setsockopt+0xdf/0x190 net/ipv6/ipv6_sockglue.c:1021 [<00000000e69fdcf8>] tcp_setsockopt+0x13b/0x2620 net/ipv4/tcp.c:3789 [<0000000090da4b9b>] __sys_setsockopt+0x239/0x620 net/socket.c:2252 [<00000000b10d192f>] __do_sys_setsockopt net/socket.c:2263 [inline] [<00000000b10d192f>] __se_sys_setsockopt net/socket.c:2260 [inline] [<00000000b10d192f>] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2260 [<000000000a80d7aa>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<000000000a80d7aa>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<000000004562b5c6>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv6/ipv6_sockglue.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index b2e03e84a2df..d3f3a2f79646 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -168,6 +168,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, rtnl_lock(); lock_sock(sk); + /* Another thread has converted the socket into IPv4 with + * IPV6_ADDRFORM concurrently. + */ + if (unlikely(sk->sk_family != AF_INET6)) + goto unlock; + switch (optname) { case IPV6_ADDRFORM: @@ -915,6 +921,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; } +unlock: release_sock(sk); if (needs_rtnl) rtnl_unlock(); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] net: mvpp2: fix mvpp2 debugfs leak
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: "Russell King (Oracle)" <rmk+kernel(a)armlinux.org.uk> mainline inclusion from mainline-v6.0-rc7 commit 0152dfee235e87660f52a117fc9f70dc55956bb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7AX CVE: CVE-2022-3535 -------------------------------- When mvpp2 is unloaded, the driver specific debugfs directory is not removed, which technically leads to a memory leak. However, this directory is only created when the first device is probed, so the hardware is present. Removing the module is only something a developer would to when e.g. testing out changes, so the module would be reloaded. So this memory leak is minor. The original attempt in commit fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") that was labelled as a memory leak fix was not, it fixed a refcount leak, but in doing so created a problem when the module is reloaded - the directory already exists, but mvpp2_root is NULL, so we lose all debugfs entries. This fix has been reverted. This is the alternative fix, where we remove the offending directory whenever the driver is unloaded. Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Parser") Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Marcin Wojtas <mw(a)semihalf.com> Link: https://lore.kernel.org/r/E1ofOAB-00CzkG-UO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/marvell/mvpp2/mvpp2.h drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 ++++++++-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 ++++++++++++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h index 46911b67b039..23f60bc5d48f 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h @@ -1107,5 +1107,6 @@ void mvpp2_percpu_write_relaxed(struct mvpp2 *priv, int cpu, u32 offset, void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name); void mvpp2_dbgfs_cleanup(struct mvpp2 *priv); +void mvpp2_dbgfs_exit(void); #endif diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c index f9744a61e5dd..d77414e1e704 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c @@ -660,6 +660,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent, return 0; } +static struct dentry *mvpp2_root; + +void mvpp2_dbgfs_exit(void) +{ + debugfs_remove(mvpp2_root); +} + void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) { debugfs_remove_recursive(priv->dbgfs_dir); @@ -667,10 +674,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) { - struct dentry *mvpp2_dir, *mvpp2_root; + struct dentry *mvpp2_dir; int ret, i; - mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL); if (!mvpp2_root) { mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); if (IS_ERR(mvpp2_root)) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index 04bee450eb3d..beb79455adc7 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -5412,7 +5412,18 @@ static struct platform_driver mvpp2_driver = { }, }; -module_platform_driver(mvpp2_driver); +static int __init mvpp2_driver_init(void) +{ + return platform_driver_register(&mvpp2_driver); +} +module_init(mvpp2_driver_init); + +static void __exit mvpp2_driver_exit(void) +{ + platform_driver_unregister(&mvpp2_driver); + mvpp2_dbgfs_exit(); +} +module_exit(mvpp2_driver_exit); MODULE_DESCRIPTION("Marvell PPv2 Ethernet Driver - www.marvell.com"); MODULE_AUTHOR("Marcin Wojtas <mw(a)semihalf.com>"); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] kcm: avoid potential race in kcm_tx_work
by Yongqiang Liu 19 Oct '22

19 Oct '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.1-rc1 commit ec7eede369fe5b0d085ac51fdbb95184f87bfc6c category: bugfix bugzilla: 187823, https://gitee.com/src-openeuler/kernel/issues/I5VZ0N CVE: CVE-2022-3521 -------------------------------- syzbot found that kcm_tx_work() could crash [1] in: /* Primarily for SOCK_SEQPACKET sockets */ if (likely(sk->sk_socket) && test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { <<*>> clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); sk->sk_write_space(sk); } I think the reason is that another thread might concurrently run in kcm_release() and call sock_orphan(sk) while sk is not locked. kcm_tx_work() find sk->sk_socket being NULL. [1] BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: null-ptr-deref in kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 Write of size 8 at addr 0000000000000008 by task kworker/u4:3/53 CPU: 0 PID: 53 Comm: kworker/u4:3 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: kkcmd kcm_tx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_write include/linux/instrumented.h:86 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Link: https://lore.kernel.org/r/20221012133412.519394-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/kcm/kcmsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index b919db02c7f9..dd83837f0fbf 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1839,10 +1839,10 @@ static int kcm_release(struct socket *sock) kcm = kcm_sk(sk); mux = kcm->mux; + lock_sock(sk); sock_orphan(sk); kfree_skb(kcm->seq_skb); - lock_sock(sk); /* Purge queue under lock to avoid race condition with tx_work trying * to act when queue is nonempty. If tx_work runs after this point * it will just return. -- 2.25.1

1 0

[PATCH openEuler-5.10 01/47] add config to control detecting conflict of opening block device
by Zheng Zengkai 19 Oct '22

19 Oct '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I53Q6M CVE: NA -------------------------------- We have a feature to add info when opening a write opend block device exclusively. Now we need to add switch to control it. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Chao Liu <liuchao173(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/Kconfig | 7 +++++++ fs/block_dev.c | 10 ++++++++++ include/linux/blk_types.h | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/block/Kconfig b/block/Kconfig index a2297edfdde8..e5c965f1ea25 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -202,6 +202,13 @@ config BLK_INLINE_ENCRYPTION_FALLBACK by falling back to the kernel crypto API when inline encryption hardware is not present. +config BLK_DEV_DUMPINFO + bool "Enable detecting conflict of opening block device" + default n + help + Dump info when open an write opened block device exclusively + or open an exclusive opened device for write + menu "Partition Types" source "block/partitions/Kconfig" diff --git a/fs/block_dev.c b/fs/block_dev.c index c8a3c93cc256..c55181b4a665 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1479,6 +1479,7 @@ int bdev_disk_changed(struct block_device *bdev, bool invalidate) */ EXPORT_SYMBOL_GPL(bdev_disk_changed); +#ifdef CONFIG_BLK_DEV_DUMPINFO static void blkdev_dump_conflict_opener(struct block_device *bdev, char *msg) { char name[BDEVNAME_SIZE]; @@ -1512,6 +1513,7 @@ static bool is_conflict_excl_open(struct block_device *bdev, struct block_device return !!whole->bd_write_openers; } +#endif /* * bd_mutex locking: * @@ -1631,6 +1633,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (for_part) bdev->bd_part_count++; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers++; @@ -1638,9 +1641,11 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, bdev->bd_contains->bd_part_write_openers++; spin_unlock(&bdev_lock); } +#endif if (claiming) { spin_lock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO /* * Open an write opened block device exclusively, the * writing process may probability corrupt the device, @@ -1649,8 +1654,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (is_conflict_excl_open(bdev, claiming, mode)) blkdev_dump_conflict_opener(bdev, "VFS: Open an write opened " "block device exclusively"); +#endif bd_finish_claiming(bdev, claiming, holder); spin_unlock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO } else if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); /* @@ -1663,6 +1670,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, blkdev_dump_conflict_opener(bdev, "VFS: Open an exclusive opened " "block device for write"); spin_unlock(&bdev_lock); +#endif } /* @@ -1881,6 +1889,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) if (for_part) bdev->bd_part_count--; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers--; @@ -1888,6 +1897,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) bdev->bd_contains->bd_part_write_openers--; spin_unlock(&bdev_lock); } +#endif if (!--bdev->bd_openers) { WARN_ON_ONCE(bdev->bd_holders); diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index bbb62ff84601..fbea6b0aef3e 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -48,7 +48,7 @@ struct block_device { int bd_fsfreeze_count; /* Mutex for freeze */ struct mutex bd_fsfreeze_mutex; -#ifndef __GENKSYMS__ +#if defined(CONFIG_BLK_DEV_DUMPINFO) && !defined(__GENKSYMS__) KABI_USE2(1, int bd_write_openers, int bd_part_write_openers); #else KABI_RESERVE(1) -- 2.20.1

1 46

[PATCH openEuler-5.10-LTS 000/168] Backport 5.10.122 LTS
by Zheng Zengkai 18 Oct '22

18 Oct '22

Backport 5.10.122 LTS patches from upstream. git cherry-pick v5.10.121..v5.10.122~1 -s Already merged(-6): 36ee9ffca8ef driver core: fix deadlock in __device_attach 6d8d3f68cbec ubi: ubi_create_volume: Fix use-after-free when volume creation failed c0868f6e728c nbd: call genl_unregister_family() first in nbd_cleanup() 122e4adaff24 nbd: fix race between nbd_alloc_config() and module removal f72df77600a4 nbd: fix io hung while disconnecting device 3be74fc0afbe powerpc/32: Fix overread/overwrite of thread_struct via ptrace Total patches: 174 - 6 = 168 Adrian Hunter (1): mmc: block: Fix CQE recovery reset success Alexander Lobakin (1): modpost: fix removing numeric suffixes Alexandru Tachici (1): iio: adc: ad7124: Remove shift from scan_type Alexey Kardashevskiy (1): powerpc/mm: Switch obsolete dssall to .long Andre Przywara (1): clocksource/drivers/sp804: Avoid error on multiple instances Baokun Li (1): jffs2: fix memory leak in jffs2_do_fill_super Bjorn Andersson (1): usb: typec: mux: Check dev_set_name() return value Brian Norris (2): drm/bridge: analogix_dp: Support PSR-exit to disable transition drm/atomic: Force bridge self-refresh-exit on CRTC switch Cameron Berkenpas (1): ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 Changbin Du (1): sysrq: do not omit current cpu when showing backtrace of all active CPUs Changcheng Liu (1): net/mlx5: correct ECE offset in query qp output Christian Borntraeger (1): s390/gmap: voluntarily schedule during key setting Christophe JAILLET (1): staging: fieldbus: Fix the error handling path in anybuss_host_common_probe() Chuck Lever (1): SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() Cixi Geng (2): iio: adc: sc27xx: fix read big scale voltage not right iio: adc: sc27xx: Fine tune the scale calibration values Damien Le Moal (2): scsi: sd: Fix potential NULL pointer dereference zonefs: fix handling of explicit_open option on mount Dan Carpenter (1): net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() Daniel Gibson (1): tty: n_tty: Restore EOF push handling behavior Dave Jiang (2): dmaengine: idxd: set DMA_INTERRUPT cap bit dmaengine: idxd: add missing callback function to support DMA_INTERRUPT David Howells (1): afs: Fix infinite loop found by xfstest generic/676 Dongliang Mu (1): f2fs: remove WARN_ON in f2fs_is_valid_blkaddr Duoming Zhou (4): drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() drivers: tty: serial: Fix deadlock in sa1100_set_termios() drivers: usb: host: Fix deadlock in oxu_bus_suspend() Eric Dumazet (3): tcp: tcp_rtx_synack() can be called from process context bpf, arm64: Clear prog->jited_len along prog->jited tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd Evan Green (1): USB: hcd-pci: Fully suspend across freeze/thaw cycle Feras Daoud (1): net/mlx5: Rearm the FW tracer after each tracer event Florian Westphal (1): netfilter: nat: really support inet nat without l3 address Gal Pressman (1): net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure Gong Yuanjun (2): mips: cpc: Fix refcount leak in mips_cpc_default_phys_base drm/radeon: fix a possible null pointer dereference Greg Ungerer (2): m68knommu: set ZERO_PAGE() to the allocated zeroed page m68knommu: fix undefined reference to `_init_sp' Guangguan Wang (1): net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" Guilherme G. Piccoli (1): coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier Guoju Fang (1): net: sched: add barrier to fix packet stuck problem for lockless qdisc Guoqing Jiang (1): md: protect md_unregister_thread from reentrancy Haibo Chen (1): gpio: pca953x: use the correct register address to do regcache sync Hangyu Hua (1): usb: usbip: fix a refcount leak in stub_probe() Hannes Reinecke (1): scsi: myrb: Fix up null pointer access on myrb_cleanup() Hao Luo (1): kernfs: Separate kernfs_pr_cont_buf and rename_lock. Heinrich Schuchardt (1): riscv: read-only pages should not be writable Hoang Le (1): tipc: check attribute length for bearer name Huang Guobin (1): tty: Fix a possible resource leak in icom_probe Ilpo Järvinen (8): serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 serial: digicolor-usart: Don't allow CS5-6 serial: rda-uart: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: sh-sci: Don't allow CS5-6 serial: sifive: Sanitize CSIZE and c_iflag serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 serial: stm32-usart: Correct CSIZE, bits, and parity Jakob Koschel (1): staging: greybus: codecs: fix type confusion of list iterator variable Jann Horn (1): s390/crypto: fix scatterwalk_unmap() callers in AES-GCM Jiasheng Jiang (1): lkdtm/bugs: Check for the NULL pointer after calling kmalloc Johan Hovold (2): phy: qcom-qmp: fix pipe-clock imbalance on power-on failure PCI: qcom: Fix pipe clock imbalance John Ogness (2): serial: meson: acquire port->lock in startup() serial: msm_serial: disable interrupts in __msm_console_write() Jun Miao (1): tracing: Fix sleeping function called from invalid context on RT kernel Kees Cook (2): lkdtm/usercopy: Expand size of "out of frame" object nodemask: Fix return values to be unsigned Kinglong Mee (1): xprtrdma: treat all calls not a bcall when bc_serv is NULL Krzysztof Kozlowski (3): rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value Kuan-Ying Lee (1): scripts/gdb: change kernel config dumping method Kuniyuki Iwashima (1): af_unix: Fix a data-race in unix_dgram_peer_wake_me(). Leo Yan (1): perf c2c: Fix sorting in percent_rmt_hitm_cmp() Leon Romanovsky (1): net/mlx5: Don't use already freed action pointer Li Jun (1): extcon: ptn5150: Add queue work sync before driver release Lin Ma (1): USB: storage: karma: fix rio_karma_init return Linus Torvalds (1): drm: imx: fix compiler warning with gcc-12 Liu Xinpeng (1): watchdog: wdat_wdt: Stop watchdog when rebooting the system Lucas Tanure (1): i2c: cadence: Increase timeout per message if necessary Maciej W. Rozycki (1): serial: sifive: Report actual baud base rather than fixed 115200 Marek Szyprowski (1): usb: dwc2: gadget: don't reset gadget's driver->bus Mark Bloch (1): net/mlx5: fs, fail conflicting actions Mark-PK Tsai (1): tracing: Avoid adding tracer option before update_tracer_options Martin Faltesek (3): nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION Martin Habets (1): sfc: fix considering that all channels have TX queues Masahiro Yamada (5): xen: unexport __init-annotated xen_xlate_map_ballooned_pages() net: mdio: unexport __init-annotated mdio_bus_init() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: ipv6: unexport __init-annotated seg6_hmac_init() modpost: fix undefined behavior of is_arm_mapping_symbol() Masami Hiramatsu (1): bootconfig: Make the bootconfig.o as a normal object file Mathias Nyman (1): Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag Maxim Mikityanskiy (1): net/mlx5e: Update netdev features after changing XDP state Menglong Dong (1): bpf: Fix probe read error in ___bpf_prog_run() Miaoqian Lin (13): tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe usb: musb: Fix missing of_node_put() in omap2430_probe iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout soc: rockchip: Fix refcount leak in rockchip_grf_init firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list net: altera: Fix refcount leak in altera_tse_mdio_create Michael Ellerman (1): powerpc/kasan: Force thread size increase with KASAN Michal Kubecek (1): Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" Miquel Raynal (1): iio: st_sensors: Add a local lock for protecting odr Niels Dossche (1): usb: usbip: add missing device lock on tweak configuration cmd Olivier Matz (2): ixgbe: fix bcast packets Rx on VF after promisc removal ixgbe: fix unexpected VLAN Rx in promisc mode on VF Pablo Neira Ayuso (5): netfilter: nf_tables: delete flowtable hooks via transaction list netfilter: nf_tables: always initialize flowtable hook list in transaction netfilter: nf_tables: release new hooks on unsupported flowtable flags netfilter: nf_tables: memleak flow rule from commit path netfilter: nf_tables: bail out early if hardware offload is not supported Pascal Hambourg (1): md/raid0: Ignore RAID0 layout if the second zone has only one device Paulo Alcantara (1): cifs: fix reconnect on smb3 mount types Peter Zijlstra (2): x86/cpu: Elide KCSAN for cpu_has() and friends jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds Radhey Shyam Pandey (1): dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type Randy Dunlap (1): pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards Samuel Holland (1): clocksource/drivers/riscv: Events are stopped during CPU suspend Saravana Kannan (1): driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction Saurabh Sengar (1): video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 Schspa Shi (1): driver: base: fix UAF when driver_attach failed Sergey Shtylyov (1): ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files Shengjiu Wang (1): ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition Sherry Sun (1): tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get Shuah Khan (1): misc: rtsx: set NULL intfdata when probe fails Shyam Prasad N (1): cifs: return errors during session setup during reconnects Stephen Boyd (2): interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: Restore sync state by ignoring ipa-virt in provider count Steve French (1): cifs: version operations for smb20 unneeded when legacy support disabled Tan Tee Min (1): net: phy: dp83867: retrigger SGMII AN when link change Tony Lindgren (1): bus: ti-sysc: Fix warnings for unbind for serial Trond Myklebust (1): NFSv4: Don't hold the layoutget locks across multiple RPC calls Uwe Kleine-König (1): pwm: lp3943: Fix duty calculation in case period was clamped Venky Shankar (1): ceph: allow ceph.dir.rctime xattr to be updatable Vincent Ray (1): net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog Wang Cheng (2): staging: rtl8712: fix uninit-value in usb_read8() and friends staging: rtl8712: fix uninit-value in r871xu_drv_init() Wang Weiyang (1): tty: goldfish: Use tty_port_destroy() to destroy port Willem de Bruijn (1): ip_gre: test csum_start instead of transport header Xiaoke Wang (2): iio: dummy: iio_simple_dummy: check the return value of kstrdup() staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Xiaomeng Tong (2): misc: fastrpc: fix an incorrect NULL check on list iterator firmware: stratix10-svc: fix a missing check on list iterator Xie Yongji (1): vringh: Fix loop descriptors check in the indirect cases Yang Yingliang (4): rtc: mt6397: check return value after calling platform_get_resource() iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() iommu/arm-smmu-v3: check return value after calling platform_get_resource() video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() Yu Xiao (1): nfp: only report pause frame configuration for physical device Zhen Ni (1): USB: host: isp116x: check return value after calling platform_get_resource() Zheng Yongjun (1): usb: dwc3: pci: Fix pm_runtime_get_sync() error checking Zheyu Ma (1): tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Zhihao Cheng (1): ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty bumwoo lee (1): extcon: Modify extcon device to be created after driver data is set huangwenhui (1): ALSA: hda/conexant - Fix loopback issue with CX20632 Íñigo Huguet (1): sfc: fix wrong tx channel offset with efx_separate_tx_channels Documentation/ABI/testing/sysfs-ata | 11 ++-- arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.machine | 1 + arch/m68k/include/asm/pgtable_no.h | 3 +- arch/mips/kernel/mips-cpc.c | 1 + arch/powerpc/Kconfig | 1 - arch/powerpc/include/asm/ppc-opcode.h | 2 + arch/powerpc/include/asm/thread_info.h | 10 +++- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/kernel/idle_6xx.S | 2 +- arch/powerpc/kernel/l2cr_6xx.S | 6 +-- arch/powerpc/kernel/swsusp_32.S | 2 +- arch/powerpc/kernel/swsusp_asm64.S | 2 +- arch/powerpc/mm/mmu_context.c | 2 +- arch/powerpc/platforms/powermac/cache.S | 4 +- arch/riscv/kernel/efi.c | 2 +- arch/s390/crypto/aes_s390.c | 4 +- arch/s390/mm/gmap.c | 14 +++++ arch/x86/include/asm/cpufeature.h | 2 +- drivers/ata/libata-transport.c | 2 +- drivers/ata/pata_octeon_cf.c | 3 ++ drivers/base/bus.c | 4 +- drivers/base/dd.c | 5 -- drivers/bus/ti-sysc.c | 4 +- drivers/clocksource/timer-oxnas-rps.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/clocksource/timer-sp804.c | 10 ++-- drivers/dma/idxd/dma.c | 23 ++++++++ drivers/dma/xilinx/zynqmp_dma.c | 5 +- drivers/extcon/extcon-ptn5150.c | 11 ++++ drivers/extcon/extcon.c | 29 +++++----- drivers/firmware/dmi-sysfs.c | 2 +- drivers/firmware/stratix10-svc.c | 12 ++--- drivers/gpio/gpio-pca953x.c | 19 ++++--- .../drm/bridge/analogix/analogix_dp_core.c | 42 +++++++++++++-- drivers/gpu/drm/drm_atomic_helper.c | 16 ++++-- drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++ .../hwtracing/coresight/coresight-cpu-debug.c | 7 +-- drivers/i2c/busses/i2c-cadence.c | 12 ++++- drivers/iio/adc/ad7124.c | 1 - drivers/iio/adc/sc27xx_adc.c | 20 +++---- drivers/iio/adc/stmpe-adc.c | 8 +-- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++--- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++--- drivers/iio/proximity/vl53l0x-i2c.c | 7 ++- drivers/input/mouse/bcm5974.c | 7 ++- drivers/interconnect/core.c | 7 ++- drivers/interconnect/qcom/sc7180.c | 21 -------- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu.c | 5 +- drivers/md/md.c | 15 ++++-- drivers/md/raid0.c | 31 +++++------ drivers/misc/cardreader/rtsx_usb.c | 1 + drivers/misc/fastrpc.c | 9 ++-- drivers/misc/lkdtm/bugs.c | 5 ++ drivers/misc/lkdtm/usercopy.c | 17 ++++-- drivers/mmc/core/block.c | 3 +- drivers/mtd/ubi/ubi.h | 4 +- drivers/net/dsa/lantiq_gswip.c | 4 +- drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/altera/altera_tse_main.c | 6 ++- .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 +-- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 ++ .../net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- .../mellanox/mlx5/core/diag/fw_tracer.c | 7 ++- .../net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++ .../net/ethernet/mellanox/mlx5/core/fs_core.c | 35 ++++++++++-- .../mellanox/mlx5/core/steering/fs_dr.c | 9 ++-- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 4 +- drivers/net/ethernet/sfc/efx_channels.c | 6 +-- drivers/net/ethernet/sfc/net_driver.h | 2 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 +- drivers/net/phy/dp83867.c | 29 ++++++++++ drivers/net/phy/mdio_bus.c | 1 - drivers/nfc/st21nfca/se.c | 53 +++++++++++-------- drivers/pci/controller/dwc/pcie-qcom.c | 6 --- drivers/pcmcia/Kconfig | 2 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- drivers/pwm/pwm-lp3943.c | 1 + drivers/rpmsg/qcom_smd.c | 4 +- drivers/rtc/rtc-mt6397.c | 2 + drivers/scsi/myrb.c | 11 ++-- drivers/scsi/sd.c | 1 - drivers/soc/rockchip/grf.c | 2 + drivers/staging/fieldbus/anybuss/host.c | 2 +- drivers/staging/greybus/audio_codec.c | 4 +- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- .../rtl8192u/ieee80211/ieee80211_softmac.c | 2 +- drivers/staging/rtl8712/os_intfs.c | 1 - drivers/staging/rtl8712/usb_intf.c | 12 ++--- drivers/staging/rtl8712/usb_ops.c | 27 ++++++---- drivers/tty/goldfish.c | 2 + drivers/tty/n_tty.c | 38 ++++++++++++- drivers/tty/serial/8250/8250_fintek.c | 8 +-- drivers/tty/serial/digicolor-usart.c | 2 + drivers/tty/serial/fsl_lpuart.c | 24 ++------- drivers/tty/serial/icom.c | 2 +- drivers/tty/serial/meson_uart.c | 13 +++++ drivers/tty/serial/msm_serial.c | 5 ++ drivers/tty/serial/owl-uart.c | 1 + drivers/tty/serial/rda-uart.c | 2 + drivers/tty/serial/sa1100.c | 4 +- drivers/tty/serial/serial_txx9.c | 2 + drivers/tty/serial/sh-sci.c | 6 ++- drivers/tty/serial/sifive.c | 8 ++- drivers/tty/serial/st-asc.c | 4 ++ drivers/tty/serial/stm32-usart.c | 15 ++++-- drivers/tty/synclink_gt.c | 2 + drivers/tty/sysrq.c | 13 +++-- drivers/usb/core/hcd-pci.c | 4 +- drivers/usb/dwc2/gadget.c | 1 - drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/host/isp116x-hcd.c | 6 ++- drivers/usb/host/oxu210hp-hcd.c | 2 + drivers/usb/musb/omap2430.c | 1 + drivers/usb/storage/karma.c | 15 +++--- drivers/usb/typec/mux.c | 14 +++-- drivers/usb/usbip/stub_dev.c | 2 +- drivers/usb/usbip/stub_rx.c | 2 + drivers/vhost/vringh.c | 10 +++- drivers/video/fbdev/hyperv_fb.c | 19 +------ drivers/video/fbdev/pxa3xx-gcu.c | 12 +++-- drivers/watchdog/rti_wdt.c | 2 +- drivers/watchdog/ts4800_wdt.c | 5 +- drivers/watchdog/wdat_wdt.c | 1 + drivers/xen/xlate_mmu.c | 1 - fs/afs/dir.c | 5 +- fs/ceph/xattr.c | 10 +++- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsfs.h | 2 +- fs/cifs/cifsglob.h | 4 +- fs/cifs/misc.c | 27 ++++++---- fs/cifs/smb2ops.c | 7 ++- fs/cifs/smb2pdu.c | 3 ++ fs/f2fs/checkpoint.c | 4 +- fs/jffs2/fs.c | 1 + fs/kernfs/dir.c | 31 ++++++----- fs/nfs/nfs4proc.c | 4 ++ fs/zonefs/super.c | 11 ++-- include/linux/iio/common/st_sensors.h | 3 ++ include/linux/jump_label.h | 4 +- include/linux/mlx5/mlx5_ifc.h | 5 +- include/linux/nodemask.h | 38 ++++++------- include/net/flow_offload.h | 1 + include/net/netfilter/nf_tables.h | 1 - include/net/netfilter/nf_tables_offload.h | 2 +- include/net/sch_generic.h | 42 +++++---------- kernel/bpf/core.c | 14 ++--- kernel/trace/trace.c | 13 +++-- lib/Makefile | 2 +- lib/nodemask.c | 4 +- net/core/flow_offload.c | 6 +++ net/ipv4/ip_gre.c | 11 ++-- net/ipv4/tcp_input.c | 11 ++-- net/ipv4/tcp_output.c | 4 +- net/ipv4/xfrm4_protocol.c | 1 - net/ipv6/seg6_hmac.c | 1 - net/key/af_key.c | 10 ++-- net/netfilter/nf_tables_api.c | 52 ++++++++---------- net/netfilter/nf_tables_offload.c | 23 +++++++- net/netfilter/nft_nat.c | 3 +- net/smc/smc_cdc.c | 2 +- net/sunrpc/xdr.c | 6 ++- net/sunrpc/xprtrdma/rpc_rdma.c | 5 ++ net/tipc/bearer.c | 3 +- net/unix/af_unix.c | 2 +- scripts/gdb/linux/config.py | 6 +-- scripts/mod/modpost.c | 5 +- sound/pci/hda/patch_conexant.c | 7 +++ sound/pci/hda/patch_realtek.c | 1 + sound/soc/fsl/fsl_sai.h | 4 +- tools/perf/builtin-c2c.c | 4 +- tools/testing/selftests/netfilter/nft_nat.sh | 43 +++++++++++++++ 174 files changed, 946 insertions(+), 508 deletions(-) -- 2.20.1

1 168

[PATCH openEuler-22.03-LTS-Ascend 01/79] mm/sharepool: Support read-only memory allocation
by Zheng Zengkai 18 Oct '22

18 Oct '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> Offering: HULK ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DS9S -------------------------------- When the driver uses the shared pool memory to share the memory with the user space, the user space is not allowed to operate this area. This prevents users from damaging sensitive data. When the sp_alloc and k2u processes apply for private memory, read-only memory can be applied for. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> --- include/linux/share_pool.h | 3 ++- mm/share_pool.c | 18 ++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 6f294911c6af..5539a17da7a9 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -15,6 +15,7 @@ #define SP_HUGEPAGE_ONLY (1 << 1) #define SP_DVPP (1 << 2) #define SP_SPEC_NODE_ID (1 << 3) +#define SP_PROT_RO (1 << 16) #define DEVICE_ID_BITS 4UL #define DEVICE_ID_MASK ((1UL << DEVICE_ID_BITS) - 1UL) @@ -24,7 +25,7 @@ #define NODE_ID_SHIFT (DEVICE_ID_SHIFT + DEVICE_ID_BITS) #define SP_FLAG_MASK (SP_HUGEPAGE | SP_HUGEPAGE_ONLY | SP_DVPP | \ - SP_SPEC_NODE_ID | \ + SP_SPEC_NODE_ID | SP_PROT_RO | \ (DEVICE_ID_MASK << DEVICE_ID_SHIFT) | \ (NODE_ID_MASK << NODE_ID_SHIFT)) diff --git a/mm/share_pool.c b/mm/share_pool.c index 76088952d0a5..99f25a551afc 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2331,6 +2331,9 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, if (spg_node) prot = spg_node->prot; + if (ac->sp_flags & SP_PROT_RO) + prot = PROT_READ; + /* when success, mmap_addr == spa->va_start */ mmap_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(mmap_addr)) { @@ -2355,6 +2358,10 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, ret = -EINVAL; goto unmap; } + + if (ac->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + /* clean PTE_RDONLY flags or trigger SMMU event */ if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); @@ -2650,6 +2657,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, goto put_mm; } + if (kc && kc->sp_flags & SP_PROT_RO) + prot = PROT_READ; + ret_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(ret_addr)) { pr_debug("k2u mmap failed %lx\n", ret_addr); @@ -2662,6 +2672,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); + if (kc && kc->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + if (is_vm_hugetlb_page(vma)) { ret = remap_vmalloc_hugepage_range(vma, (void *)kva, 0); if (ret) { @@ -2713,6 +2726,7 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un struct sp_area *spa; struct spg_proc_stat *stat; unsigned long prot = PROT_READ | PROT_WRITE; + struct sp_k2u_context kc; down_write(&sp_group_sem); stat = sp_init_process_stat(current, current->mm, spg_none); @@ -2731,8 +2745,8 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un } spa->kva = kva; - - uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, NULL); + kc.sp_flags = sp_flags; + uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, &kc); __sp_area_drop(spa); if (IS_ERR(uva)) pr_err("remap k2u to task failed %ld\n", PTR_ERR(uva)); -- 2.20.1

1 78

2024

2023

2022

2021

2020

2019

Kernel October 2022