October 2023 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] x86/microcode/AMD: Fix compile fail
by liwei 18 Oct '23

18 Oct '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88UBD?from=project-issue CVE: NA ---------------------------------- When CONFIG_MICROCODE_AMD is not defined, the reload_ucode_amd function is implemented by multiple files in the header file. As a result, multiple definition of reload_ucode_amd. Fix this error. Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/microcode_amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h index bdecac3ae8c3..b56a1c0d5f60 100644 --- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -54,7 +54,7 @@ static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } -void reload_ucode_amd(void) {} +static inline void reload_ucode_amd(void) {} static inline void amd_check_microcode(void) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ -- 2.25.1

2 1

[OLK-5.10 v2 0/7] A set of bugfixes for openeuler
by Chengchang Tang 18 Oct '23

18 Oct '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Chengchang Tang (6): RDMA/hns: Fix context dca configuration RDMA/hns: Fix potential NULL pointer in DCA memory query RDMA/hns: Fix registering dca debugfs when dca has not been set RDMA/hns: Fix printing level of asynchronous events RDMA/hns: Fix signed-unsigned mix with relational RDMA/hns: Fix unregistering device and accessing to debugfs concurrently Junxian Huang (1): RDMA/hns: Fix the concurrency error between bond and reset. drivers/infiniband/hw/hns/hns_roce_bond.c | 153 ++++++++++++++----- drivers/infiniband/hw/hns/hns_roce_bond.h | 1 + drivers/infiniband/hw/hns/hns_roce_dca.c | 10 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 7 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 22 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 4 +- drivers/infiniband/hw/hns/hns_roce_main.c | 3 +- 7 files changed, 143 insertions(+), 57 deletions(-) -- 2.30.0

1 7

[PATCH OLK-5.10] igb: set max size RX buffer when store bad packet is enabled
by Lu Wei 18 Oct '23

18 Oct '23

From: Radoslaw Tyl <radoslawx.tyl(a)intel.com> stable inclusion from stable-v5.10.195 commit 3e39008e9e3043663324f0920a5d6ebfa68cc92a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885ON CVE: CVE-2023-45871 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f upstream. Increase the RX buffer size to 3K when the SBP bit is on. The size of the RX buffer determines the number of pages allocated which may not be sufficient for receive frames larger than the set MTU size. Cc: stable(a)vger.kernel.org Fixes: 89eaefb61dc9 ("igb: Support RX-ALL feature flag.") Reported-by: Manfred Rudigier <manfred.rudigier(a)omicronenergy.com> Signed-off-by: Radoslaw Tyl <radoslawx.tyl(a)intel.com> Tested-by: Arpana Arland <arpanax.arland(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index b5ab3bcb0751..2f219229a95e 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -4733,6 +4733,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter, static void igb_set_rx_buffer_len(struct igb_adapter *adapter, struct igb_ring *rx_ring) { +#if (PAGE_SIZE < 8192) + struct e1000_hw *hw = &adapter->hw; +#endif + /* set build_skb and buffer size flags */ clear_ring_build_skb_enabled(rx_ring); clear_ring_uses_large_buffer(rx_ring); @@ -4743,10 +4747,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter, set_ring_build_skb_enabled(rx_ring); #if (PAGE_SIZE < 8192) - if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB) - return; - - set_ring_uses_large_buffer(rx_ring); + if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB || + rd32(E1000_RCTL) & E1000_RCTL_SBP) + set_ring_uses_large_buffer(rx_ring); #endif } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] igb: set max size RX buffer when store bad packet is enabled
by Lu Wei 18 Oct '23

18 Oct '23

From: Radoslaw Tyl <radoslawx.tyl(a)intel.com> mainline inclusion from mainline-v6.6-rc1 commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885ON Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Increase the RX buffer size to 3K when the SBP bit is on. The size of the RX buffer determines the number of pages allocated which may not be sufficient for receive frames larger than the set MTU size. Cc: stable(a)vger.kernel.org Fixes: 89eaefb61dc9 ("igb: Support RX-ALL feature flag.") Reported-by: Manfred Rudigier <manfred.rudigier(a)omicronenergy.com> Signed-off-by: Radoslaw Tyl <radoslawx.tyl(a)intel.com> Tested-by: Arpana Arland <arpanax.arland(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 6d9b8e81b44d..bebfeaf5aa26 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -4561,6 +4561,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter, static void igb_set_rx_buffer_len(struct igb_adapter *adapter, struct igb_ring *rx_ring) { +#if (PAGE_SIZE < 8192) + struct e1000_hw *hw = &adapter->hw; +#endif + /* set build_skb and buffer size flags */ clear_ring_build_skb_enabled(rx_ring); clear_ring_uses_large_buffer(rx_ring); @@ -4571,10 +4575,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter, set_ring_build_skb_enabled(rx_ring); #if (PAGE_SIZE < 8192) - if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB) - return; - - set_ring_uses_large_buffer(rx_ring); + if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB || + rd32(E1000_RCTL) & E1000_RCTL_SBP) + set_ring_uses_large_buffer(rx_ring); #endif } -- 2.34.1

2 1

[PATCH OLK-5.10] audit: fix possible soft lockup in __audit_inode_child()
by Yi Yang 17 Oct '23

17 Oct '23

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v5.10.195 commit 98ef243d5900d75a64539a2165745bffbb155d43 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88UP7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4. mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 07e2788bbbf1..57b982b44732 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2203,6 +2203,8 @@ void __audit_inode_child(struct inode *parent, } } + cond_resched(); + /* is there a matching child entry? */ list_for_each_entry(n, &context->names_list, list) { /* can only match entries that have a name */ -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/5] Fixed five CVE vulnerabilities of ksmbd.
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

2 6

[PATCH OLK-5.10 0/5] Fixed five CVE vulnerabilities of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

2 6

[PATCH OLK-5.10] xhci: print warning when HCE was set
by Longfang Liu 17 Oct '23

17 Oct '23

mainline inclusion from mainline-v6.2-rc1 commit 2a25e66d676dfb9b018abd503deed3d38a892dec category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I87TGP CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When HCE(Host Controller Error) is set, it means that the xhci hardware controller has an error at this time, but the current xhci driver software does not log this event. By adding an HCE event detection in the xhci interrupt processing interface, a warning log is output to the system, which is convenient for system device status tracking. Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20221130091944.2171610-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/host/xhci-ring.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 935368c6b31d..d99ea8492749 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2935,6 +2935,11 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (!(status & STS_EINT)) goto out; + if (status & STS_HCE) { + xhci_warn(xhci, "WARNING: Host Controller Error\n"); + goto out; + } + if (status & STS_FATAL) { xhci_warn(xhci, "WARNING: Host System Error\n"); xhci_halt(xhci); -- 2.24.0

2 1

[PATCH openEuler-1.0-LTS v2] audit: fix possible soft lockup in __audit_inode_child()
by Yi Yang 17 Oct '23

17 Oct '23

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.295 commit 1640c7bd4eddec6c72f3a99cbb74e333a2ce9f5d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88RR0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4. mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- v2:Fix checkformat error --- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 57d30b75f7a2..61fd210f0226 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1931,6 +1931,8 @@ void __audit_inode_child(struct inode *parent, } } + cond_resched(); + /* is there a matching child entry? */ list_for_each_entry(n, &context->names_list, list) { /* can only match entries that have a name */ -- 2.25.1

2 1

[PATCH OLK-5.10 0/5] Fix 5 CVE of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

1 5

[PATCH OLK-5.10 0/5] Fix 5 CVE of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

1 5

[PATCH openEuler-1.0-LTS] audit: fix possible soft lockup in __audit_inode_child()
by Yi Yang 17 Oct '23

17 Oct '23

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.295 commit 1640c7bd4eddec6c72f3a99cbb74e333a2ce9f5d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88RR0 CVE: NA Reference:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/… -------------------------------- [ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4. mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 57d30b75f7a2..61fd210f0226 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1931,6 +1931,8 @@ void __audit_inode_child(struct inode *parent, } } + cond_resched(); + /* is there a matching child entry? */ list_for_each_entry(n, &context->names_list, list) { /* can only match entries that have a name */ -- 2.34.1

2 1

[PATCH OLK-5.10 00/24] coresight: Add new API to allocate trace source ID values
by Junhao He 17 Oct '23

17 Oct '23

From: xiabing <xiabing12(a)h-partners.com> The current method for allocating trace source ID values to sources is to use a fixed algorithm for CPU based sources of (cpu_num * 2 + 0x10). The STM is allocated ID 0x1. This fixed algorithm is used in both the CoreSight driver code, and by perf when writing the trace metadata in the AUXTRACE_INFO record. The method needs replacing as currently:- 1. It is inefficient in using available IDs. 2. Does not scale to larger systems with many cores and the algorithm has no limits so will generate invalid trace IDs for cpu number > 44. Additionally requirements to allocate additional system IDs on some systems have been seen. This patch set introduces an API that allows the allocation of trace IDs in a dynamic manner. Architecturally reserved IDs are never allocated, and the system is limited to allocating only valid IDs. Each of the current trace sources ETM3.x, ETM4.x and STM is updated to use the new API. For the ETMx.x devices IDs are allocated on certain events a) When using sysfs, an ID will be allocated on hardware enable, or a read of sysfs TRCTRACEID register and freed when the sysfs reset is written. b) When using perf, ID is allocated on during setup AUX event, and freed on event free. IDs are communicated using the AUX_OUTPUT_HW_ID packet. The ID allocator is notified when perf sessions start and stop so CPU based IDs are kept constant throughout any perf session. Adrian Hunter (1): perf/x86: Add new event for AUX output counter index German Gomez (1): perf cs_etm: Keep separate symbols for ETMv4 and ETE parameters James Clark (4): perf cs-etm: Tidy up auxtrace info header printing perf cs-etm: Cleanup cs_etm__process_auxtrace_info() perf cs-etm: Print unknown header version as an error perf cs-etm: Print auxtrace info even if OpenCSD isn't linked Mike Leach (15): coresight: trace-id: Add API to dynamically assign Trace ID values coresight: Remove obsolete Trace ID unniqueness checks coresight: perf: traceid: Add perf ID allocation and notifiers coresight: stm: Update STM driver to use Trace ID API coresight: etm4x: Update ETM4 driver to use Trace ID API coresight: etm3x: Update ETM3 driver to use Trace ID API coresight: etmX.X: stm: Remove trace_id() callback coresight: trace id: Remove legacy get trace ID function. perf cs-etm: Move mapping of Trace ID and cpu into helper function perf cs-etm: Update record event to use new Trace ID protocol kernel: events: Export perf_report_aux_output_id() perf cs-etm: Handle PERF_RECORD_AUX_OUTPUT_HW_ID packet coresight: events: PERF_RECORD_AUX_OUTPUT_HW_ID used for Trace ID coresight: trace-id: Add debug & test macros to Trace ID allocation coresight: etm4x: Fix missing trctraceidr file in sysfs Ruidong Tian (1): coresight: perf: Release Coresight path when alloc trace id failed Suzuki K Poulose (1): coresight: perf: Output trace id only once xiabing (1): Revert "drivers/ETM: fix error in invalid cs_id" .../testing/sysfs-bus-coresight-devices-etm3x | 2 +- arch/x86/events/core.c | 6 + arch/x86/events/intel/core.c | 16 + arch/x86/events/perf_event.h | 1 + drivers/hwtracing/coresight/Makefile | 2 +- drivers/hwtracing/coresight/coresight-core.c | 45 -- .../hwtracing/coresight/coresight-etm-perf.c | 32 + .../hwtracing/coresight/coresight-etm-perf.h | 2 + drivers/hwtracing/coresight/coresight-etm.h | 3 +- .../coresight/coresight-etm3x-core.c | 93 +-- .../coresight/coresight-etm3x-sysfs.c | 27 +- .../coresight/coresight-etm4x-core.c | 73 ++- .../coresight/coresight-etm4x-sysfs.c | 50 +- drivers/hwtracing/coresight/coresight-etm4x.h | 3 + drivers/hwtracing/coresight/coresight-stm.c | 49 +- .../hwtracing/coresight/coresight-trace-id.c | 297 ++++++++++ .../hwtracing/coresight/coresight-trace-id.h | 156 +++++ include/linux/coresight-pmu.h | 35 +- include/linux/coresight.h | 3 - include/linux/perf_event.h | 1 + include/uapi/linux/perf_event.h | 15 + kernel/events/core.c | 31 + tools/include/linux/coresight-pmu.h | 48 +- tools/perf/arch/arm/util/cs-etm.c | 66 ++- tools/perf/util/Build | 1 + tools/perf/util/cs-etm-base.c | 191 ++++++ .../perf/util/cs-etm-decoder/cs-etm-decoder.c | 7 + tools/perf/util/cs-etm.c | 546 ++++++++++-------- tools/perf/util/cs-etm.h | 37 +- 29 files changed, 1387 insertions(+), 451 deletions(-) create mode 100644 drivers/hwtracing/coresight/coresight-trace-id.c create mode 100644 drivers/hwtracing/coresight/coresight-trace-id.h create mode 100644 tools/perf/util/cs-etm-base.c -- 2.30.0

2 25

[PATCH OLK-5.10 0/4] CVE-2023-37453
by Lin Yujun 17 Oct '23

17 Oct '23

*** BLURB HERE *** Alan Stern (4): USB: core: Unite old scheme and new scheme descriptor reads USB: core: Change usb_get_device_descriptor() API USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() USB: core: Fix oversight in SuperSpeed initialization drivers/usb/core/hcd.c | 10 +- drivers/usb/core/hub.c | 349 +++++++++++++++++++++---------------- drivers/usb/core/message.c | 29 ++- drivers/usb/core/usb.h | 4 +- 4 files changed, 223 insertions(+), 169 deletions(-) -- 2.34.1

2 5

[PATCH] xhci: print warning when HCE was set
by Longfang Liu 17 Oct '23

17 Oct '23

mainline inclusion from mainline-v6.2-rc1 commit 2a25e66d676dfb9b018abd503deed3d38a892dec category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I87TGP CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When HCE(Host Controller Error) is set, it means that the xhci hardware controller has an error at this time, but the current xhci driver software does not log this event. By adding an HCE event detection in the xhci interrupt processing interface, a warning log is output to the system, which is convenient for system device status tracking. Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20221130091944.2171610-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/host/xhci-ring.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 935368c6b31d..d99ea8492749 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2935,6 +2935,11 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (!(status & STS_EINT)) goto out; + if (status & STS_HCE) { + xhci_warn(xhci, "WARNING: Host Controller Error\n"); + goto out; + } + if (status & STS_FATAL) { xhci_warn(xhci, "WARNING: Host System Error\n"); xhci_halt(xhci); -- 2.24.0

1 0

[PATCH openEuler-1.0-LTS v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index a95b50342dbb..58ba402bc0b0 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH OLK-5.10 v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 177b40d08098..117d4615d668 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] Fix 4 CVE of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 Namjae Jeon (3): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel fs/ksmbd/connection.c | 54 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 ++++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 ++++++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 24 ++++++++-------- 7 files changed, 116 insertions(+), 34 deletions(-) -- 2.34.3

2 4

[PATCH OLK-5.10] crypto: drbg - Only fail when jent is unavailable in FIPS mode
by Lu Jialin 17 Oct '23

17 Oct '23

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.180 commit 2a67bc52cd3f0783ac412d8007ae7bdd04911b10 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88MMY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] When jent initialisation fails for any reason other than ENOENT, the entire drbg fails to initialise, even when we're not in FIPS mode. This is wrong because we can still use the kernel RNG when we're not in FIPS mode. Change it so that it only fails when we are in FIPS mode. Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: Stephan Mueller <smueller(a)chronox.de> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: crypto/drbg.c Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- crypto/drbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/drbg.c b/crypto/drbg.c index a4b5d6dbe99d..3019a26c5021 100644 --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -1573,7 +1573,7 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, if (IS_ERR(drbg->jent)) { ret = PTR_ERR(drbg->jent); drbg->jent = NULL; - if (fips_enabled || ret != -ENOENT) + if (fips_enabled) goto free_everything; pr_info("DRBG: Continuing without Jitter RNG\n"); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 17 Oct '23

17 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885FJ CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index 4d261e4de9ad..e6768662c5ed 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -940,7 +940,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 17 Oct '23

17 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88NEK CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index 4d261e4de9ad..e6768662c5ed 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -940,7 +940,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[OLK-5.10] crypto: drbg - Only fail when jent is unavailable in FIPS mode
by Lu Jialin 17 Oct '23

17 Oct '23

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.180 commit 2a67bc52cd3f0783ac412d8007ae7bdd04911b10 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88MMY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] When jent initialisation fails for any reason other than ENOENT, the entire drbg fails to initialise, even when we're not in FIPS mode. This is wrong because we can still use the kernel RNG when we're not in FIPS mode. Change it so that it only fails when we are in FIPS mode. Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: Stephan Mueller <smueller(a)chronox.de> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: crypto/drbg.c Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- crypto/drbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/drbg.c b/crypto/drbg.c index a4b5d6dbe99d..3019a26c5021 100644 --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -1573,7 +1573,7 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, if (IS_ERR(drbg->jent)) { ret = PTR_ERR(drbg->jent); drbg->jent = NULL; - if (fips_enabled || ret != -ENOENT) + if (fips_enabled) goto free_everything; pr_info("DRBG: Continuing without Jitter RNG\n"); } -- 2.34.1

1 0

[PATCH v5 OLK-5.10 00/19] Introduce PBHA and PBHA bit0 to control the usage of HBM Cache precisely
by Wupeng Ma 17 Oct '23

17 Oct '23

From: Ma Wupeng <mawupeng1(a)huawei.com> Patch 1: move FDT init out of kaslr_early_init for future use. Patch 2 to 8: enable feature PBHA for arm64. Patch 9-18: Control the usage of HBM cache for kernel and task precisely. Patch 19: Enable feature PBHA for arm64 by default. Changelog since v4: - update pbha_bit0_update_pgprot to pgprot_pbha_bit0 Changelog since v3: - update desc for patch #15 Changelog since v2: - correct the error Documentation in patch #18 Changelog since v1: - fix kabi broken due to include files James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (11): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default Marc Zyngier (1): arm64: Extract early FDT mapping from kaslr_early_init() .../admin-guide/kernel-parameters.txt | 8 + Documentation/arm64/index.rst | 1 + Documentation/arm64/pbha.rst | 85 +++ .../devicetree/bindings/arm/cpu.yaml | 537 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 584 +++--------------- arch/arm64/Kconfig | 20 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpucaps.h | 3 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 10 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 3 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 6 +- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/kaslr.c | 7 +- arch/arm64/kernel/setup.c | 15 + arch/arm64/kvm/reset.c | 15 +- arch/arm64/mm/hugetlbpage.c | 2 + arch/arm64/mm/mmu.c | 14 +- arch/arm64/mm/ptdump.c | 5 + .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 57 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 204 ++++++ fs/proc/base.c | 103 +++ fs/proc/task_mmu.c | 3 + include/linux/mm.h | 8 +- include/linux/pbha.h | 66 ++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 2 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 5 + 38 files changed, 1579 insertions(+), 523 deletions(-) create mode 100644 Documentation/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h -- 2.25.1

2 20

[PATCH OLK-5.10,v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 177b40d08098..117d4615d668 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS,v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index a95b50342dbb..58ba402bc0b0 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

1 0