April 2023 - Kernel - mailweb.openeuler.org

Re: [openEuler-22.03-LTS,v1,0/6] Add perf metricgroup support for HiSilicon hip08 platform
by patchwork bot 23 Apr '23

23 Apr '23

your patch has been converted to a pull request, pull request link is: https://gitee.com/openeuler/kernel/pulls/609

1 0

[PATCH openEuler-22.03-LTS v1 0/6] Add perf metricgroup support for HiSilicon hip08 platform
by Wei Li 23 Apr '23

23 Apr '23

Add perf metricgroup support for HiSilicon hip08 platform, tested on Huawei D06 board. John Garry (6): perf metricgroup: Make find_metric() public with name change perf test: Handle metric reuse in pmu-events parsing test perf pmu: Add pmu_events_map__find() function to find the common PMU map for the system perf vendor events arm64: Add Hisi hip08 L1 metrics perf vendor events arm64: Add Hisi hip08 L2 metrics perf vendor events arm64: Add Hisi hip08 L3 metrics tools/perf/arch/arm64/util/Build | 1 + tools/perf/arch/arm64/util/pmu.c | 25 ++ .../arch/arm64/hisilicon/hip08/metrics.json | 233 ++++++++++++++++++ tools/perf/tests/pmu-events.c | 83 ++++++- tools/perf/util/metricgroup.c | 11 +- tools/perf/util/metricgroup.h | 3 +- tools/perf/util/pmu.c | 5 + tools/perf/util/pmu.h | 1 + tools/perf/util/s390-sample-raw.c | 4 +- 9 files changed, 356 insertions(+), 10 deletions(-) create mode 100644 tools/perf/arch/arm64/util/pmu.c create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip08/metrics.json -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS] audit: fix a memleak caused by auditing load module
by Yongqiang Liu 23 Apr '23

23 Apr '23

From: Li RongQing <lirongqing(a)baidu.com> mainline inclusion from mainline-v5.2-rc1 commit 95e0b46fcebd7dbf6850dee96046e4c4ddc7f69c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6X2LV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- module.name will be allocated unconditionally when auditing load module, and audit_log_start() can fail with other reasons, or audit_log_exit maybe not called, caused module.name is not freed so free module.name in audit_free_context and __audit_syscall_exit unreferenced object 0xffff88af90837d20 (size 8): comm "modprobe", pid 1036, jiffies 4294704867 (age 3069.138s) hex dump (first 8 bytes): 69 78 67 62 65 00 ff ff ixgbe... backtrace: [<0000000008da28fe>] __audit_log_kern_module+0x33/0x80 [<00000000c1491e61>] load_module+0x64f/0x3850 [<000000007fc9ae3f>] __do_sys_init_module+0x218/0x250 [<0000000000d4a478>] do_syscall_64+0x117/0x400 [<000000004924ded8>] entry_SYSCALL_64_after_hwframe+0x49/0xbe [<000000007dc331dd>] 0xffffffffffffffff Fixes: ca86cad7380e3 ("audit: log module name on init_module") Signed-off-by: Zhang Yu <zhangyu31(a)baidu.com> Signed-off-by: Li RongQing <lirongqing(a)baidu.com> [PM: manual merge fixup in __audit_syscall_exit()] Signed-off-by: Paul Moore <paul(a)paul-moore.com> conflict: kernel/auditsc.c Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: cuigaosheng <cuigaosheng1(a)huawei.com> Reviewed-by: guozihua <guozihua(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/auditsc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 1513873e23bd..57d30b75f7a2 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -881,6 +881,13 @@ static inline void audit_proctitle_free(struct audit_context *context) context->proctitle.len = 0; } +static inline void audit_free_module(struct audit_context *context) +{ + if (context->type == AUDIT_KERN_MODULE) { + kfree(context->module.name); + context->module.name = NULL; + } +} static inline void audit_free_names(struct audit_context *context) { struct audit_names *n, *next; @@ -964,6 +971,7 @@ int audit_alloc(struct task_struct *tsk) static inline void audit_free_context(struct audit_context *context) { + audit_free_module(context); audit_free_names(context); unroll_tree_refs(context, NULL, 0); free_tree_refs(context); @@ -1281,7 +1289,6 @@ static void show_special(struct audit_context *context, int *call_panic) audit_log_format(ab, "name="); if (context->module.name) { audit_log_untrustedstring(ab, context->module.name); - kfree(context->module.name); } else audit_log_format(ab, "(null)"); @@ -1583,6 +1590,7 @@ void __audit_syscall_exit(int success, long return_code) if (!list_empty(&context->killed_trees)) audit_kill_trees(&context->killed_trees); + audit_free_module(context); audit_free_names(context); unroll_tree_refs(context, NULL, 0); audit_free_aux(context); -- 2.25.1

1 0

[PATCH OLK-5.10 v1 0/6] Add perf metricgroup support for HiSilicon hip08 platform
by Wei Li 23 Apr '23

23 Apr '23

Add perf metricgroup support for HiSilicon hip08 platform, tested on Huawei D06 board. John Garry (6): perf metricgroup: Make find_metric() public with name change perf test: Handle metric reuse in pmu-events parsing test perf pmu: Add pmu_events_map__find() function to find the common PMU map for the system perf vendor events arm64: Add Hisi hip08 L1 metrics perf vendor events arm64: Add Hisi hip08 L2 metrics perf vendor events arm64: Add Hisi hip08 L3 metrics tools/perf/arch/arm64/util/Build | 1 + tools/perf/arch/arm64/util/pmu.c | 25 ++ .../arch/arm64/hisilicon/hip08/metrics.json | 233 ++++++++++++++++++ tools/perf/tests/pmu-events.c | 83 ++++++- tools/perf/util/metricgroup.c | 11 +- tools/perf/util/metricgroup.h | 3 +- tools/perf/util/pmu.c | 5 + tools/perf/util/pmu.h | 1 + tools/perf/util/s390-sample-raw.c | 4 +- 9 files changed, 356 insertions(+), 10 deletions(-) create mode 100644 tools/perf/arch/arm64/util/pmu.c create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip08/metrics.json -- 2.25.1

2 7

Re: [PATCH v3] mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()
by Zheng Zengkai 22 Apr '23

22 Apr '23

在 2023/4/17 21:12, Kefeng Wang 写道: > + Zengkai > > Could you merge this patch? +zhangjialin Hi Kefeng and Kang Chen Is this patch same as the one in PR #582(https://gitee.com/openeuler/kernel/pulls/582) ? If so，let's tracking it via the gitee PR, Here are some notices about contribution to openEuler kernel: https://gitee.com/openeuler/kernel/issues/I6WKLA Thank you! > > On 2023/4/17 19:13, Kang Chen wrote: >> hulk inclusion >> category: bugfix >> bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NYW4 >> CVE: NA >> >> -------------------------------- >> >> raw call flow: >> >> oom_kill_process >> -> mem_cgroup_scan_tasks(.., .., message) >> -> memcg_print_bad_task(message, ..) >> >> message is "const char*" type, and incorrectly cast to >> "oom_control*" type in memcg_print_bad_task. > > a blank line, > >> Fix it by moving memcg_print_bad_task out of mem_cgroup_scan_tasks >> and call it in select_bad_process and dump_tasks. Furthermore, >> use struct oom_control* directly and remove the useless parm `ret`. >> > > Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> > >> Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> >> --- >> v3 -> v2: use type `struct oom_control *` directly and fix bugs >> v2 -> v1: remove parm `ret` and create a memcg_print_bad_task stub >> >> mm/memcontrol.c | 16 +++++++++------- >> mm/oom_kill.c | 14 ++++++++------ >> 2 files changed, 17 insertions(+), 13 deletions(-) >> >> diff --git a/mm/memcontrol.c b/mm/memcontrol.c >> index 635cb8b65b86..6b4f70d090d6 100644 >> --- a/mm/memcontrol.c >> +++ b/mm/memcontrol.c >> @@ -1214,9 +1214,6 @@ int mem_cgroup_scan_tasks(struct mem_cgroup >> *memcg, >> break; >> } >> } >> -#ifdef CONFIG_MEMCG_QOS >> - memcg_print_bad_task(arg, ret); >> -#endif >> return ret; >> } >> @@ -4004,14 +4001,12 @@ bool memcg_low_priority_scan_tasks(int >> (*fn)(struct task_struct *, void *), >> return oc->chosen ? true : false; >> } >> -void memcg_print_bad_task(void *arg, int ret) >> +void memcg_print_bad_task(struct oom_control *oc) >> { >> - struct oom_control *oc = arg; >> - >> if (!static_branch_likely(&memcg_qos_stat_key)) >> return; >> - if (!ret && oc->chosen) { >> + if (oc->chosen) { >> struct mem_cgroup *memcg; >> memcg = mem_cgroup_from_task(oc->chosen); >> @@ -4042,6 +4037,13 @@ int sysctl_memcg_qos_handler(struct ctl_table >> *table, int write, >> return ret; >> } >> + >> +#else >> + >> +void memcg_print_bad_task(struct oom_control *oc) >> +{ >> +} >> + >> #endif >> #ifdef CONFIG_NUMA >> diff --git a/mm/oom_kill.c b/mm/oom_kill.c >> index 0f77eb4c6644..9d595265bbf5 100644 >> --- a/mm/oom_kill.c >> +++ b/mm/oom_kill.c >> @@ -408,9 +408,10 @@ static void select_bad_process(struct >> oom_control *oc) >> { >> oc->chosen_points = LONG_MIN; >> - if (is_memcg_oom(oc)) >> - mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); >> - else { >> + if (is_memcg_oom(oc)) { >> + if (!mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc)) >> + memcg_print_bad_task(oc); >> + } else { >> struct task_struct *p; >> #ifdef CONFIG_MEMCG_QOS >> @@ -473,9 +474,10 @@ static void dump_tasks(struct oom_control *oc) >> pr_info("Tasks state (memory values in pages):\n"); >> pr_info("[ pid ] uid tgid total_vm rss pgtables_bytes >> swapents oom_score_adj name\n"); >> - if (is_memcg_oom(oc)) >> - mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); >> - else { >> + if (is_memcg_oom(oc)) { >> + if (!mem_cgroup_scan_tasks(oc->memcg, dump_task, oc)) >> + memcg_print_bad_task(oc); >> + } else { >> struct task_struct *p; >> rcu_read_lock(); > . >

3 2

[PATCH openEuler-1.0-LTS 0/6] efi: fix crash due to EFI runtime service page faults
by Ding Hui 20 Apr '23

20 Apr '23

For both arm64 and x86, handle and recovery from page faults due to EFI runtime service, and disable subsequent invoking, we can avoid crash the whole system when running on buggy EFI firmware, and get log like this: kernel: [Firmware Bug]: Unable to handle paging request in EFI runtime service kernel: CPU: 54 PID: 8 Comm: kworker/u256:0 Kdump: loaded Tainted: G IOE 4.19.90-2112.8.0.0131.oe1.aarch64.debug #66 kernel: Hardware name: O.D.M FT-2500 Platform/T1DMFT-E4 , BIOS KL4.26.ODM.S.032.210904.R 09/04/21 13:28:40 kernel: Workqueue: efi_rts_wq efi_call_rts kernel: Call trace: kernel: dump_backtrace+0x0/0x170 kernel: show_stack+0x24/0x30 kernel: dump_stack+0xa4/0xe8 kernel: efi_runtime_fixup_exception+0x74/0x8c kernel: __do_kernel_fault+0x8c/0x150 kernel: do_page_fault+0x78/0x4c8 kernel: do_translation_fault+0xa8/0xbc kernel: do_mem_abort+0x50/0xe0 kernel: el1_da+0x20/0x94 kernel: 0x213f0c24 kernel: 0x213f0d64 kernel: 0x213f044c kernel: 0x213f04b4 kernel: 0x213f0178 kernel: 0x212e0664 kernel: __efi_rt_asm_wrapper+0x50/0x6c kernel: efi_call_rts+0x414/0x430 kernel: process_one_work+0x1f8/0x490 kernel: worker_thread+0x50/0x4b8 kernel: kthread+0x134/0x138 kernel: ret_from_fork+0x10/0x18 kernel: [Firmware Bug]: Synchronous exception occurred in EFI runtime service get_time() kernel: rtc-efi rtc-efi: can't read time kernel: efi: EFI Runtime Services are disabled! Anders Roxell (1): efi: Fix build error due to enum collision between efi.h and ima.h Ard Biesheuvel (1): arm64: efi: Recover from synchronous exceptions occurring in firmware Sai Praneeth (2): efi: Make efi_rts_work accessible to efi page fault handler efi/x86: Handle page faults occurring while running EFI runtime services Sami Tolvanen (1): arm64: efi: Restore register x18 if it was corrupted Waiman Long (1): efi: Fix debugobjects warning on 'efi_rts_work' arch/arm64/include/asm/efi.h | 9 ++ arch/arm64/kernel/efi-rt-wrapper.S | 46 +++++++++- arch/arm64/kernel/efi.c | 26 ++++++ arch/arm64/mm/fault.c | 4 + arch/x86/include/asm/efi.h | 1 + arch/x86/mm/fault.c | 9 ++ arch/x86/platform/efi/quirks.c | 78 +++++++++++++++++ drivers/firmware/efi/runtime-wrappers.c | 107 +++++++++--------------- include/linux/efi.h | 42 ++++++++++ 9 files changed, 252 insertions(+), 70 deletions(-) -- 2.17.1

1 6

[PATCH openEuler-1.0-LTS] iommu/arm-smmu-v3: Fix UAF when handle evt during iommu group removing
by Ding Hui 20 Apr '23

20 Apr '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6WKM7 CVE: NA -------- A use-after-free issue like following: [ 2257.819189] arm-smmu-v3 arm-smmu-v3.4.auto: EVTQ overflow detected -- events lost [ 2257.819197] arm-smmu-v3 arm-smmu-v3.4.auto: event 0x10 received: [ 2257.819199] arm-smmu-v3 arm-smmu-v3.4.auto: 0x0000820000000010 [ 2257.819201] arm-smmu-v3 arm-smmu-v3.4.auto: 0x0000020000000000 [ 2257.819202] arm-smmu-v3 arm-smmu-v3.4.auto: 0x00000000dfea7218 [ 2257.819206] iommu: Removing device 0000:82:00.0 from group 49 [ 2257.819207] arm-smmu-v3 arm-smmu-v3.4.auto: 0x00000000dfea7000 [ 2257.819211] arm-smmu-v3 arm-smmu-v3.4.auto: event 0x10 received: [ 2257.819212] arm-smmu-v3 arm-smmu-v3.4.auto: 0x0000820000000010 [ 2257.819214] arm-smmu-v3 arm-smmu-v3.4.auto: 0x0000020000000000 [ 2257.819215] arm-smmu-v3 arm-smmu-v3.4.auto: 0x00000000dfea722c [ 2257.819216] arm-smmu-v3 arm-smmu-v3.4.auto: 0x00000000dfea7000 [ 2257.819218] ================================================================== [ 2257.819228] BUG: KASAN: use-after-free in iommu_report_device_fault+0x520/0x5c0 [ 2257.819230] Read of size 8 at addr ffffa02c516c1320 by task irq/63-arm-smmu/483 [ 2257.819231] [ 2257.819235] CPU: 25 PID: 483 Comm: irq/63-arm-smmu Kdump: loaded Tainted: G OE 4.19.90-2205.3.0.0149.oe1.aarch64+debug #1 [ 2257.819236] Hardware name: Huawei S920S00/BC82AMDGK, BIOS 1.68 11/10/2020 [ 2257.819237] Call trace: [ 2257.819240] dump_backtrace+0x0/0x320 [ 2257.819242] show_stack+0x24/0x30 [ 2257.819246] dump_stack+0xdc/0x128 [ 2257.819251] print_address_description+0x68/0x278 [ 2257.819253] kasan_report+0x1e4/0x308 [ 2257.819254] __asan_report_load8_noabort+0x30/0x40 [ 2257.819257] iommu_report_device_fault+0x520/0x5c0 [ 2257.819260] arm_smmu_handle_evt+0x300/0x428 [ 2257.819261] arm_smmu_evtq_thread+0x27c/0x460 [ 2257.819264] irq_thread_fn+0x88/0x140 [ 2257.819266] irq_thread+0x190/0x318 [ 2257.819268] kthread+0x2a4/0x320 [ 2257.819270] ret_from_fork+0x10/0x18 [ 2257.819271] [ 2257.819273] Allocated by task 95166: [ 2257.819275] kasan_kmalloc+0xd0/0x178 [ 2257.819277] kmem_cache_alloc_trace+0x100/0x210 [ 2257.819279] iommu_group_add_device+0x254/0xe18 [ 2257.819280] iommu_group_get_for_dev+0x198/0x480 [ 2257.819282] arm_smmu_add_device+0x424/0x988 [ 2257.819284] iort_iommu_configure+0x33c/0x5b8 [ 2257.819287] acpi_dma_configure+0x9c/0xf8 [ 2257.819289] pci_dma_configure+0x124/0x158 [ 2257.819291] dma_configure+0x5c/0x80 [ 2257.819294] really_probe+0xcc/0x920 [ 2257.819296] driver_probe_device+0x224/0x308 [ 2257.819298] __device_attach_driver+0x154/0x260 [ 2257.819299] bus_for_each_drv+0xe4/0x178 [ 2257.819301] __device_attach+0x1bc/0x2a8 [ 2257.819302] device_attach+0x24/0x30 [ 2257.819304] pci_bus_add_device+0x7c/0xe8 [ 2257.819305] pci_bus_add_devices+0x70/0x168 [ 2257.819307] pci_bus_add_devices+0x114/0x168 [ 2257.819308] pci_rescan_bus+0x38/0x48 [ 2257.819310] bus_rescan_store+0xc4/0xe8 [ 2257.819312] bus_attr_store+0x70/0x98 [ 2257.819314] sysfs_kf_write+0x104/0x170 [ 2257.819316] kernfs_fop_write+0x23c/0x430 [ 2257.819319] __vfs_write+0x7c/0xe8 [ 2257.819320] vfs_write+0x12c/0x3d0 [ 2257.819321] ksys_write+0xd4/0x1d8 [ 2257.819322] __arm64_sys_write+0x70/0xa0 [ 2257.819325] el0_svc_common+0xfc/0x278 [ 2257.819327] el0_svc_handler+0x50/0xc0 [ 2257.819329] el0_svc+0x8/0x1b0 [ 2257.819329] [ 2257.819330] Freed by task 95166: [ 2257.819332] __kasan_slab_free+0x114/0x200 [ 2257.819334] kasan_slab_free+0x10/0x18 [ 2257.819335] kfree+0x80/0x1f0 [ 2257.819337] iommu_group_remove_device+0x27c/0x560 [ 2257.819338] arm_smmu_remove_device+0xe8/0x190 [ 2257.819339] iommu_bus_notifier+0x134/0x248 [ 2257.819342] notifier_call_chain+0xb0/0x140 [ 2257.819343] blocking_notifier_call_chain+0x6c/0xd8 [ 2257.819344] device_del+0x578/0x940 [ 2257.819346] pci_remove_bus_device+0x114/0x290 [ 2257.819347] pci_stop_and_remove_bus_device_locked+0x2c/0x40 [ 2257.819349] remove_store+0xdc/0xe8 [ 2257.819352] dev_attr_store+0x60/0x80 [ 2257.819353] sysfs_kf_write+0x104/0x170 [ 2257.819354] kernfs_fop_write+0x23c/0x430 [ 2257.819355] __vfs_write+0x7c/0xe8 [ 2257.819357] vfs_write+0x12c/0x3d0 [ 2257.819358] ksys_write+0xd4/0x1d8 [ 2257.819359] __arm64_sys_write+0x70/0xa0 [ 2257.819361] el0_svc_common+0xfc/0x278 [ 2257.819362] el0_svc_handler+0x50/0xc0 [ 2257.819364] el0_svc+0x8/0x1b0 [ 2257.819364] T0 T1 --------------------------------- --------------------------------- |- arm_smmu_evtq_thread |- arm_smmu_remove_device |- arm_smmu_handle_evt |- iommu_group_remove_device |- kfree(dev->iommu_param) |- arm_smmu_find_master |- iommu_report_device_fault |- arm_smmu_remove_master |- mutex_lock( \ &dev->iommu_param->lock) // UAF Reference upstream mainline commit 395ad89d11fd93f79a6b942e91fc409807a63c4b, move arm_smmu_remove_master() before iommu_group_remove_device(), and hold mutex to protect finding master and subsequent handling. Fixes: b525f0a6f9b0 ("iommu/arm-smmu-v3: Add stall support for platform devices") Signed-off-by: Ding Hui <dinghui(a)sangfor.com.cn> --- drivers/iommu/arm-smmu-v3.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 3309ae6ebc0b..05cb92da6836 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -1742,7 +1742,8 @@ arm_smmu_find_master(struct arm_smmu_device *smmu, u32 sid) struct arm_smmu_stream *stream; struct arm_smmu_master_data *master = NULL; - mutex_lock(&smmu->streams_mutex); + lockdep_assert_held(&smmu->streams_mutex); + node = smmu->streams.rb_node; while (node) { stream = rb_entry(node, struct arm_smmu_stream, node); @@ -1755,7 +1756,6 @@ arm_smmu_find_master(struct arm_smmu_device *smmu, u32 sid) break; } } - mutex_unlock(&smmu->streams_mutex); return master; } @@ -1791,9 +1791,12 @@ static int arm_smmu_handle_evt(struct arm_smmu_device *smmu, u64 *evt) if (evt[1] & EVTQ_1_S2) return -EFAULT; + mutex_lock(&smmu->streams_mutex); master = arm_smmu_find_master(smmu, sid); - if (!master) - return -EINVAL; + if (!master) { + ret = -EINVAL; + goto out_unlock; + } /* * The domain is valid until the fault returns, because detach() flushes @@ -1833,6 +1836,8 @@ static int arm_smmu_handle_evt(struct arm_smmu_device *smmu, u64 *evt) arm_smmu_page_response(master->dev, &resp); } +out_unlock: + mutex_unlock(&smmu->streams_mutex); return ret; } @@ -2935,8 +2940,8 @@ static void arm_smmu_remove_device(struct device *dev) iopf_queue_remove_device(dev); if (master->ste.assigned) arm_smmu_detach_dev(dev); - iommu_group_remove_device(dev); arm_smmu_remove_master(smmu, master); + iommu_group_remove_device(dev); iommu_device_unlink(&smmu->iommu, dev); kfree(master); iommu_fwspec_free(dev); -- 2.17.1

1 0

ODD2023-Kernel SIG 开放工作会议
by openEuler conference 19 Apr '23

19 Apr '23

您好！ Kernel SIG 邀请您参加 2023-04-21 16:00 召开的Zoom会议(自动录制) 会议主题：ODD2023-Kernel SIG 开放工作会议会议内容： 1. 华中大网安学院内核贡献团队组建经验分享 2. 互联网领域的挑战与技术 3. ext4文件系统问题（一致性、稳定性）的挖掘和定位 4. 可编程内核技术落地场景分享和未来畅想欢迎继续申报议题~ 会议链接：https://us06web.zoom.us/j/88277699752?pwd=VTB3ZjhFR1pKd0syc3NpMDVDcVRvZz09 会议纪要：https://etherpad.openeuler.org/p/ODD2023_Kernel_SIG 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-04-21 16:00, The subject of the conference is ODD2023-Kernel SIG 开放工作会议, Summary: 1. 华中大网安学院内核贡献团队组建经验分享 2. 互联网领域的挑战与技术 3. ext4文件系统问题（一致性、稳定性）的挖掘和定位 4. 可编程内核技术落地场景分享和未来畅想欢迎继续申报议题~ You can join the meeting at https://us06web.zoom.us/j/88277699752?pwd=VTB3ZjhFR1pKd0syc3NpMDVDcVRvZz09. Add topics at https://etherpad.openeuler.org/p/ODD2023_Kernel_SIG. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

一文解锁 → openEuler Developer Day 2023 游玩指南
by openEuler 19 Apr '23

19 Apr '23

1 0

[PATCH openEuler-1.0-LTS 1/2] x86/speculation: Allow enabling STIBP with legacy IBRS
by Yongqiang Liu 19 Apr '23

19 Apr '23

From: KP Singh <kpsingh(a)kernel.org> stable inclusion from stable-v4.19.276 commit 10543fb3c9b019e45e2045f08f46fdf526add593 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6V7TU CVE: CVE-2023-1998 -------------------------------- commit 6921ed9049bc7457f66c1596c5b78aec0dae4a9d upstream. When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation() determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for enabling STIBP (through seccomp/prctl() by default or always-on, if selected by spectre_v2_user kernel cmdline parameter). [ bp: Massage. ] Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Reported-by: José Oliveira <joseloliveira11(a)gmail.com> Reported-by: Rodrigo Branco <rodrigo(a)kernelhacking.com> Signed-off-by: KP Singh <kpsingh(a)kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20230220120127.1975241-1-kpsingh@kernel.org Link: https://lore.kernel.org/r/20230221184908.2349578-1-kpsingh@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/cpu/bugs.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 836000481438..a7becbe9a890 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -973,14 +973,18 @@ spectre_v2_parse_user_cmdline(void) return SPECTRE_V2_USER_CMD_AUTO; } -static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode) { - return mode == SPECTRE_V2_IBRS || - mode == SPECTRE_V2_EIBRS || + return mode == SPECTRE_V2_EIBRS || mode == SPECTRE_V2_EIBRS_RETPOLINE || mode == SPECTRE_V2_EIBRS_LFENCE; } +static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +{ + return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS; +} + static void __init spectre_v2_user_select_mitigation(void) { @@ -1043,12 +1047,19 @@ spectre_v2_user_select_mitigation(void) } /* - * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible, - * STIBP is not required. + * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP + * is not required. + * + * Enhanced IBRS also protects against cross-thread branch target + * injection in user-mode as the IBRS bit remains always set which + * implicitly enables cross-thread protections. However, in legacy IBRS + * mode, the IBRS bit is set only on kernel entry and cleared on return + * to userspace. This disables the implicit cross-thread protection, + * so allow for STIBP to be selected in that case. */ if (!boot_cpu_has(X86_FEATURE_STIBP) || !smt_possible || - spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return; /* @@ -2084,7 +2095,7 @@ static ssize_t mmio_stale_data_show_state(char *buf) static char *stibp_state(void) { - if (spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + if (spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return ""; switch (spectre_v2_user_stibp) { -- 2.25.1

1 1

[PATCH openEuler-22.03-LTS 00/26] Backport CVEs and bugfixes
by Jialin Zhang 18 Apr '23

18 Apr '23

Pull new CVEs: CVE-2023-1829 CVE-2022-36280 CVE-2022-1015 CVE-2023-1989 CVE-2023-30456 CVE-2023-1990 xfs bugfixes from Long Li and yangerkun

1 26

[PATCH openEuler-22.03-LTS-SP1 00/26] Backport CVEs and bugfixes
by Jialin Zhang 18 Apr '23

18 Apr '23

Pull new CVEs: CVE-2023-1829 CVE-2022-36280 CVE-2022-1015 CVE-2023-1989 CVE-2023-30456 CVE-2023-1990 xfs bugfixes from Long Li and yangerkun

1 26

[PATCH OLK-5.10 00/26] Backport CVEs and bugfixes
by Jialin Zhang 18 Apr '23

18 Apr '23

Pull new CVEs: CVE-2023-1829 CVE-2022-36280 CVE-2022-1015 CVE-2023-1989 CVE-2023-30456 CVE-2023-1990 xfs bugfixes from Long Li and yangerkun

1 26

[PATCH OLK-5.10 000/370] Backport 5.10.150 LTS
by Jialin Zhang 18 Apr '23

18 Apr '23

Backport 5.10.150 LTS patches from upstream. Conflicts: Already merged(19): f039b43cbaea inet: fully convert sk->sk_rx_dst to RCU rules 45c33966759e mm: hugetlb: fix UAF in hugetlb_handle_userfault c378c479c517 io_uring/af_unix: defer registered files gc to io_uring release 67cbc8865a66 io_uring: correct pinned_vm accounting 904f881b5736 arm64: topology: fix possible overflow in amu_fie_setup() dbcca76435a6 HID: roccat: Fix use-after-free in roccat_read() 484400d433ca r8152: Rate limit overflow messages d88b88514ef2 crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr 657de36c72f5 arm64: ftrace: fix module PLTs with mcount 29f50bcf0f8b net: mvpp2: fix mvpp2 debugfs leak 6cc0e2afc6a1 bnx2x: fix potential memory leak in bnx2x_tpa_stop() 2a1d03632085 mISDN: fix use-after-free bugs in l1oip timer handlers 0cf6c09dafee ring-buffer: Fix race between reset page and reading page fbb0e601bd51 ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate 483831ad0440 ext4: fix check for block being out of directory size f34ab9516276 ext4: fix null-ptr-deref in ext4_write_info e50472949604 fbdev: smscufx: Fix use-after-free in ufx_ops_open() 7d551b7d6114 block: fix inflight statistics of part0 6b7ae4a904a4 quota: Check next/prev free block number after reading from quota file Context conflict(1): c13d0d2f5a48 usb: host: xhci-plat: suspend and resume clocks Total patches: 389 - 19 = 370

1 370

[PATCH OLK-5.10] x86/speculation: Allow enabling STIBP with legacy IBRS
by Wei Li 18 Apr '23

18 Apr '23

From: KP Singh <kpsingh(a)kernel.org> stable inclusion from stable-v5.10.173 commit abfed855f05863d292de2d0ebab4656791bab9c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6V7TU CVE: CVE-2023-1998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6921ed9049bc7457f66c1596c5b78aec0dae4a9d upstream. When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation() determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for enabling STIBP (through seccomp/prctl() by default or always-on, if selected by spectre_v2_user kernel cmdline parameter). [ bp: Massage. ] Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Reported-by: José Oliveira <joseloliveira11(a)gmail.com> Reported-by: Rodrigo Branco <rodrigo(a)kernelhacking.com> Signed-off-by: KP Singh <kpsingh(a)kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20230220120127.1975241-1-kpsingh@kernel.org Link: https://lore.kernel.org/r/20230221184908.2349578-1-kpsingh@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- arch/x86/kernel/cpu/bugs.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 25f3fad210e0..0dd4f8a8d821 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1051,14 +1051,18 @@ spectre_v2_parse_user_cmdline(void) return SPECTRE_V2_USER_CMD_AUTO; } -static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode) { - return mode == SPECTRE_V2_IBRS || - mode == SPECTRE_V2_EIBRS || + return mode == SPECTRE_V2_EIBRS || mode == SPECTRE_V2_EIBRS_RETPOLINE || mode == SPECTRE_V2_EIBRS_LFENCE; } +static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +{ + return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS; +} + static void __init spectre_v2_user_select_mitigation(void) { @@ -1121,12 +1125,19 @@ spectre_v2_user_select_mitigation(void) } /* - * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible, - * STIBP is not required. + * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP + * is not required. + * + * Enhanced IBRS also protects against cross-thread branch target + * injection in user-mode as the IBRS bit remains always set which + * implicitly enables cross-thread protections. However, in legacy IBRS + * mode, the IBRS bit is set only on kernel entry and cleared on return + * to userspace. This disables the implicit cross-thread protection, + * so allow for STIBP to be selected in that case. */ if (!boot_cpu_has(X86_FEATURE_STIBP) || !smt_possible || - spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return; /* @@ -2220,7 +2231,7 @@ static ssize_t mmio_stale_data_show_state(char *buf) static char *stibp_state(void) { - if (spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + if (spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return ""; switch (spectre_v2_user_stibp) { -- 2.25.1

1 0

[PATCH v3] mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()
by Kang Chen 17 Apr '23

17 Apr '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NYW4 CVE: NA -------------------------------- raw call flow: oom_kill_process -> mem_cgroup_scan_tasks(.., .., message) -> memcg_print_bad_task(message, ..) message is "const char*" type, and incorrectly cast to "oom_control*" type in memcg_print_bad_task. Fix it by moving memcg_print_bad_task out of mem_cgroup_scan_tasks and call it in select_bad_process and dump_tasks. Furthermore, use struct oom_control* directly and remove the useless parm `ret`. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- v3 -> v2: use type `struct oom_control *` directly and fix bugs v2 -> v1: remove parm `ret` and create a memcg_print_bad_task stub mm/memcontrol.c | 16 +++++++++------- mm/oom_kill.c | 14 ++++++++------ 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..6b4f70d090d6 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1214,9 +1214,6 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, break; } } -#ifdef CONFIG_MEMCG_QOS - memcg_print_bad_task(arg, ret); -#endif return ret; } @@ -4004,14 +4001,12 @@ bool memcg_low_priority_scan_tasks(int (*fn)(struct task_struct *, void *), return oc->chosen ? true : false; } -void memcg_print_bad_task(void *arg, int ret) +void memcg_print_bad_task(struct oom_control *oc) { - struct oom_control *oc = arg; - if (!static_branch_likely(&memcg_qos_stat_key)) return; - if (!ret && oc->chosen) { + if (oc->chosen) { struct mem_cgroup *memcg; memcg = mem_cgroup_from_task(oc->chosen); @@ -4042,6 +4037,13 @@ int sysctl_memcg_qos_handler(struct ctl_table *table, int write, return ret; } + +#else + +void memcg_print_bad_task(struct oom_control *oc) +{ +} + #endif #ifdef CONFIG_NUMA diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 0f77eb4c6644..9d595265bbf5 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -408,9 +408,10 @@ static void select_bad_process(struct oom_control *oc) { oc->chosen_points = LONG_MIN; - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); - else { + if (is_memcg_oom(oc)) { + if (!mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc)) + memcg_print_bad_task(oc); + } else { struct task_struct *p; #ifdef CONFIG_MEMCG_QOS @@ -473,9 +474,10 @@ static void dump_tasks(struct oom_control *oc) pr_info("Tasks state (memory values in pages):\n"); pr_info("[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name\n"); - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); - else { + if (is_memcg_oom(oc)) { + if (!mem_cgroup_scan_tasks(oc->memcg, dump_task, oc)) + memcg_print_bad_task(oc); + } else { struct task_struct *p; rcu_read_lock(); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
by Yongqiang Liu 17 Apr '23

17 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.3-rc3 commit 5000fe6c27827a61d8250a7e4a1d26c3298ef4f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6UW64 CVE: CVE-2023-1990 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- This bug influences both st_nci_i2c_remove and st_nci_spi_remove. Take st_nci_i2c_remove as an example. In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work with llt_ndlc_sm_work. When it calls ndlc_recv or timeout handler, it will finally call schedule_work to start the work. When we call st_nci_i2c_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in ndlc_remove CPU0 CPU1 |llt_ndlc_sm_work st_nci_i2c_remove | ndlc_remove | st_nci_remove | nci_free_device| kfree(ndev) | //free ndlc->ndev | |llt_ndlc_rcv_queue |nci_recv_frame |//use ndlc->ndev Fixes: 35630df68d60 ("NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20230312160837.2040857-1-zyytlz.wz@163.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/nfc/st-nci/ndlc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/nfc/st-nci/ndlc.c b/drivers/nfc/st-nci/ndlc.c index f26d938d240f..12d73f9dbe9f 100644 --- a/drivers/nfc/st-nci/ndlc.c +++ b/drivers/nfc/st-nci/ndlc.c @@ -297,13 +297,15 @@ EXPORT_SYMBOL(ndlc_probe); void ndlc_remove(struct llt_ndlc *ndlc) { - st_nci_remove(ndlc->ndev); - /* cancel timers */ del_timer_sync(&ndlc->t1_timer); del_timer_sync(&ndlc->t2_timer); ndlc->t2_active = false; ndlc->t1_active = false; + /* cancel work */ + cancel_work_sync(&ndlc->sm_work); + + st_nci_remove(ndlc->ndev); skb_queue_purge(&ndlc->rcv_q); skb_queue_purge(&ndlc->send_q); -- 2.25.1

1 0

[PATCH v2] mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()
by Kang Chen 17 Apr '23

17 Apr '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NYW4 CVE: NA -------------------------------- raw call flow: oom_kill_process -> mem_cgroup_scan_tasks(.., .., message) -> memcg_print_bad_task(message, ..) message is "const char*" type, and incorrectly cast to "oom_control*" type in memcg_print_bad_task. Fix it by moving memcg_print_bad_task out of mem_cgroup_scan_tasks and call it in select_bad_process and dump_tasks. Furthermore, remove the useless parm `ret`. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- v2 -> v1: remove parm `ret` and create a memcg_print_bad_task stub mm/memcontrol.c | 14 +++++++++----- mm/oom_kill.c | 14 ++++++++------ 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..e87a96a6c712 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1214,9 +1214,6 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, break; } } -#ifdef CONFIG_MEMCG_QOS - memcg_print_bad_task(arg, ret); -#endif return ret; } @@ -4004,14 +4001,14 @@ bool memcg_low_priority_scan_tasks(int (*fn)(struct task_struct *, void *), return oc->chosen ? true : false; } -void memcg_print_bad_task(void *arg, int ret) +void memcg_print_bad_task(void *arg) { struct oom_control *oc = arg; if (!static_branch_likely(&memcg_qos_stat_key)) return; - if (!ret && oc->chosen) { + if (oc->chosen) { struct mem_cgroup *memcg; memcg = mem_cgroup_from_task(oc->chosen); @@ -4042,6 +4039,13 @@ int sysctl_memcg_qos_handler(struct ctl_table *table, int write, return ret; } + +#else + +void memcg_print_bad_task(void *arg) +{ +} + #endif #ifdef CONFIG_NUMA diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 0f77eb4c6644..03df1a9093b5 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -408,9 +408,10 @@ static void select_bad_process(struct oom_control *oc) { oc->chosen_points = LONG_MIN; - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); - else { + if (is_memcg_oom(oc)) { + if (mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc)) + memcg_print_bad_task(oc); + } else { struct task_struct *p; #ifdef CONFIG_MEMCG_QOS @@ -473,9 +474,10 @@ static void dump_tasks(struct oom_control *oc) pr_info("Tasks state (memory values in pages):\n"); pr_info("[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name\n"); - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); - else { + if (is_memcg_oom(oc)) { + if (mem_cgroup_scan_tasks(oc->memcg, dump_task, oc)) + memcg_print_bad_task(oc); + } else { struct task_struct *p; rcu_read_lock(); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
by Yongqiang Liu 17 Apr '23

17 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.3-rc7 commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6UW68 CVE: CVE-2023-1989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove. Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/bluetooth/btsdio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c index 20142bc77554..1325b1df4a8e 100644 --- a/drivers/bluetooth/btsdio.c +++ b/drivers/bluetooth/btsdio.c @@ -356,6 +356,7 @@ static void btsdio_remove(struct sdio_func *func) if (!data) return; + cancel_work_sync(&data->work); hdev = data->hdev; sdio_set_drvdata(func, NULL); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
by Yongqiang Liu 17 Apr '23

17 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.3-rc7 commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6UW68 CVE: CVE-2023-1989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove. Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/bluetooth/btsdio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c index 20142bc77554..1325b1df4a8e 100644 --- a/drivers/bluetooth/btsdio.c +++ b/drivers/bluetooth/btsdio.c @@ -356,6 +356,7 @@ static void btsdio_remove(struct sdio_func *func) if (!data) return; + cancel_work_sync(&data->work); hdev = data->hdev; sdio_set_drvdata(func, NULL); -- 2.25.1

1 0

[PATCH rdma-core v3 0/2] Add support for SVE Direct WQE
by Chengchang Tang 17 Apr '23

17 Apr '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Yixing Liu (2): Update kernel headers libhns: Add support for SVE Direct WQE CMakeLists.txt | 1 + buildlib/RDMA_EnableCStd.cmake | 17 +++++++++++++++++ kernel-headers/rdma/hns-abi.h | 1 + providers/hns/CMakeLists.txt | 5 +++++ providers/hns/hns_roce_u_hw_v2.c | 21 ++++++++++++++++++++- 5 files changed, 44 insertions(+), 1 deletion(-) -- 2.30.0

1 0

[PATCH v4] eulerfs: fix wrong dereferencing in eufs_lookup
by Kang Chen 17 Apr '23

17 Apr '23

uniontech inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TN56 CVE: NA -------------------------------- smatch report: fs/eulerfs/namei.c:118 eufs_lookup() error: 'inode' dereferencing possible ERR_PTR() fix it by using the ino above in eufs_err. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- I think we need use IS_ERR to handle all errors, the err can't pass to BUG_ON line later. v4 -> v3: fix some bugs and return EIO/ENOMEM anyway. v3 -> v2: use IS_ERR to handle all kind err v2 -> v1: use correct string format fs/eulerfs/namei.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/eulerfs/namei.c b/fs/eulerfs/namei.c index e4c6c36575f2..7064de644b34 100644 --- a/fs/eulerfs/namei.c +++ b/fs/eulerfs/namei.c @@ -114,9 +114,11 @@ static struct dentry *eufs_lookup(struct inode *dir, struct dentry *dentry, goto not_found; inode = eufs_iget(dir->i_sb, s2p(dir->i_sb, de->inode)); - if (inode == ERR_PTR(-ESTALE)) { - eufs_err(dir->i_sb, "deleted inode referenced: 0x%lx", - inode->i_ino); + if (IS_ERR(inode)) { + eufs_err(dir->i_sb, "eufs_iget failed ino 0x%llx err %d\n", + le64_to_cpu(de->inode), PTR_ERR(inode)); + if (inode == ERR_PTR(-ENOMEM)) + return ERR_PTR(-ENOMEM); return ERR_PTR(-EIO); } not_found: -- 2.34.1

3 2

[PATCH] mm: move memcg_print_bad_task out of mem_cgroup_scan_tasks to avoid wrong type cast
by Kang Chen 16 Apr '23

16 Apr '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NYW4 CVE: NA -------------------------------- raw call flow: oom_kill_process -> mem_cgroup_scan_tasks(.., .., message) -> memcg_print_bad_task(message, ..) message is "const char*" type, and incorrectly cast to "oom_control*" type in memcg_print_bad_task. Fix it by moving memcg_print_bad_task out of mem_cgroup_scan_tasks and call it in select_bad_process and dump_tasks. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- mm/memcontrol.c | 3 --- mm/oom_kill.c | 24 ++++++++++++++++++------ 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..8e0d5d484153 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1214,9 +1214,6 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, break; } } -#ifdef CONFIG_MEMCG_QOS - memcg_print_bad_task(arg, ret); -#endif return ret; } diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 0f77eb4c6644..1e3ba16dd748 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -406,11 +406,17 @@ static int oom_evaluate_task(struct task_struct *task, void *arg) */ static void select_bad_process(struct oom_control *oc) { + int ret; oc->chosen_points = LONG_MIN; - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); - else { + if (is_memcg_oom(oc)) { + ret = mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); + +#ifdef CONFIG_MEMCG_QOS + memcg_print_bad_task(oc, ret); +#endif + + } else { struct task_struct *p; #ifdef CONFIG_MEMCG_QOS @@ -470,12 +476,18 @@ static int dump_task(struct task_struct *p, void *arg) */ static void dump_tasks(struct oom_control *oc) { + int ret; pr_info("Tasks state (memory values in pages):\n"); pr_info("[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name\n"); - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); - else { + if (is_memcg_oom(oc)) { + ret = mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); + +#ifdef CONFIG_MEMCG_QOS + memcg_print_bad_task(oc, ret); +#endif + + } else { struct task_struct *p; rcu_read_lock(); -- 2.34.1

1 0

[PATCH OLK-5.10 0/8] SAS-related bugfix
by Yihang Li 14 Apr '23

14 Apr '23

From: xiabing <xiabing12(a)h-partners.com> *** BLURB HERE *** Jie Zhan (3): scsi: libsas: Add smp_ata_check_ready_type() scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset scsi: libsas: Do not export sas_ata_wait_after_reset() Martin K. Petersen (1): scsi: sd: Reorganize DIF/DIX code to avoid calling revalidate twice Xingui Yang (1): scsi: sd: Update DIX config every time sd_revalidate_disk() is called Yihang Li (3): scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id scsi: hisi_sas: Exit suspending state when usage count is greater than 0 scsi: hisi_sas: Ensure all enabled PHYs up during controller reset drivers/scsi/hisi_sas/hisi_sas_main.c | 42 ++++++++++++--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 73 ++++++++++++++++++++------ drivers/scsi/libsas/sas_ata.c | 28 +++++++++- drivers/scsi/libsas/sas_expander.c | 4 +- drivers/scsi/libsas/sas_internal.h | 2 + drivers/scsi/sd.c | 59 +++++++++++---------- drivers/scsi/sd_dif.c | 12 ++--- include/scsi/sas_ata.h | 7 ++- 8 files changed, 161 insertions(+), 66 deletions(-) -- 2.30.0

1 8

快看，内核&编译器领域 SIG组来啦！诚邀您参加 openEuler Developer Day 2023
by openEuler 14 Apr '23

14 Apr '23

1 0