November 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] sctp: properly validate chunk size in sctp_sf_ootb()
by Liu Jian 26 Nov '24

26 Nov '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.230 commit 40b283ba76665437bc2ac72079c51b57b25bff9e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5ARH CVE: CVE-2024-50299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ] A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf_ootb() to address a crash reported by syzbot: BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 Reported-by: syzbot+f0cbb34d39392f2746ca(a)syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.173022398… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sctp/sm_statefuns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index ee0b2b03657c..eca081710ed3 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -3637,7 +3637,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, } ch = (struct sctp_chunkhdr *)ch_end; - } while (ch_end < skb_tail_pointer(skb)); + } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); if (ootb_shut_ack) return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] CVE-2024-53059
by Liu Jian 26 Nov '24

26 Nov '24

CVE-2024-53059 Daniel Gabay (1): wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() Emmanuel Grumbach (1): wifi: iwlwifi: mvm: disconnect station vifs if recovery failed Johannes Berg (2): mac80211: do drv_reconfig_complete() before restarting all mac80211: always have ieee80211_sta_restart() Youghandhar Chintala (1): mac80211: Add support to trigger sta disconnect on hardware restart drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 22 +++++++--- include/net/mac80211.h | 10 +++++ net/mac80211/ieee80211_i.h | 3 ++ net/mac80211/mlme.c | 14 ++++++- net/mac80211/util.c | 45 ++++++++++++++++----- 5 files changed, 78 insertions(+), 16 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] sctp: properly validate chunk size in sctp_sf_ootb()
by Liu Jian 26 Nov '24

26 Nov '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.230 commit 40b283ba76665437bc2ac72079c51b57b25bff9e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5ARH CVE: CVE-2024-50299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ] A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf_ootb() to address a crash reported by syzbot: BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 Reported-by: syzbot+f0cbb34d39392f2746ca(a)syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.173022398… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sctp/sm_statefuns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 1e82c51657a7..93ebd14b48ed 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -3637,7 +3637,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, } ch = (struct sctp_chunkhdr *)ch_end; - } while (ch_end < skb_tail_pointer(skb)); + } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); if (ootb_shut_ack) return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sctp: properly validate chunk size in sctp_sf_ootb()
by Liu Jian 26 Nov '24

26 Nov '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.324 commit 67b9a278b80f71ec62091ded97c6bcbea33b5ec3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5ARH CVE: CVE-2024-50299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ] A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf_ootb() to address a crash reported by syzbot: BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 Reported-by: syzbot+f0cbb34d39392f2746ca(a)syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.173022398… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sctp/sm_statefuns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 373be2a1be7d..bde3a8174aef 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -3652,7 +3652,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, } ch = (struct sctp_chunkhdr *)ch_end; - } while (ch_end < skb_tail_pointer(skb)); + } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); if (ootb_shut_ack) return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands); -- 2.34.1

2 1

[openeuler:OLK-5.10 2470/2470] drivers/vdpa/vdpa_sim/vdpa_sim_net.c:36:4: sparse: sparse: symbol 'macaddr_buf' was not declared. Should it be static?
by kernel test robot 26 Nov '24

26 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b72e8e3239b08473e630c6c751eb719791d2f843 commit: d4a6c405d07d2c7eb60a781368d94c476ebe24ab [2470/2470] vdpa: split vdpasim to core and net modules config: x86_64-randconfig-123-20241123 (https://download.01.org/0day-ci/archive/20241126/202411261934.oQXSmYd5-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241126/202411261934.oQXSmYd5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411261934.oQXSmYd5-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/vdpa/vdpa_sim/vdpa_sim_net.c:36:4: sparse: sparse: symbol 'macaddr_buf' was not declared. Should it be static? vim +/macaddr_buf +36 drivers/vdpa/vdpa_sim/vdpa_sim_net.c 35 > 36 u8 macaddr_buf[ETH_ALEN]; 37 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
by Yi Yang 26 Nov '24

26 Nov '24

mainline inclusion from mainline-v6.13-rc1 commit 662f2f13e66d3883b9238b0b96b17886179e60e2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7RZMT Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and decryption operations return -EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns -EAGAIN, the unnecessary panic will occur when panic_on_warn set 1. Fix this issue by calling crypto layer directly without parallelization in that case. Fixes: 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/pcrypt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index 005a36cb21bc..2d7f98709e97 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -117,8 +117,10 @@ static int pcrypt_aead_encrypt(struct aead_request *req) err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu); if (!err) return -EINPROGRESS; - if (err == -EBUSY) - return -EAGAIN; + if (err == -EBUSY) { + /* try non-parallel mode */ + return crypto_aead_encrypt(creq); + } return err; } @@ -166,8 +168,10 @@ static int pcrypt_aead_decrypt(struct aead_request *req) err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu); if (!err) return -EINPROGRESS; - if (err == -EBUSY) - return -EAGAIN; + if (err == -EBUSY) { + /* try non-parallel mode */ + return crypto_aead_decrypt(creq); + } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6] ima: fix buffer overrun in ima_eventdigest_init_common
by Gu Bowen 26 Nov '24

26 Nov '24

From: Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> stable inclusion from stable-v6.6.63 commit 8a84765c62cc0469864e2faee43aae253ad16082 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB75G4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 923168a0631bc42fffd55087b337b1b6c54dcff5 upstream. Function ima_eventdigest_init() calls ima_eventdigest_init_common() with HASH_ALGO__LAST which is then used to access the array hash_digest_size[] leading to buffer overrun. Have a conditional statement to handle this. Fixes: 9fab303a2cb3 ("ima: fix violation measurement list record") Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> Tested-by: Enrico Bravi (PhD at polito.it) <enrico.bravi(a)huawei.com> Cc: stable(a)vger.kernel.org # 5.19+ Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/integrity/ima/ima_template_lib.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c index 4bcc77c092b6..bd74b87ad438 100644 --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -318,15 +318,21 @@ static int ima_eventdigest_init_common(const u8 *digest, u32 digestsize, hash_algo_name[hash_algo]); } - if (digest) + if (digest) { memcpy(buffer + offset, digest, digestsize); - else + } else { /* * If digest is NULL, the event being recorded is a violation. * Make room for the digest by increasing the offset by the - * hash algorithm digest size. + * hash algorithm digest size. If the hash algorithm is not + * specified increase the offset by IMA_DIGEST_SIZE which + * fits SHA1 or MD5 */ - offset += hash_digest_size[hash_algo]; + if (hash_algo < HASH_ALGO__LAST) + offset += hash_digest_size[hash_algo]; + else + offset += IMA_DIGEST_SIZE; + } return ima_write_template_field_data(buffer, offset + digestsize, fmt, field_data); -- 2.25.1

2 1

[openeuler:OLK-6.6 1527/1527] net/ipv4/tcp_output.c:1312:5: warning: variable 'tcp_hdr_rsrvd_4b' set but not used
by kernel test robot 26 Nov '24

26 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b95a35e8702cd5f262398a1706786f090a72ca4c commit: abe6bde15def9470fe18af30626e62d51f651dd9 [1527/1527] net: tcp: Modify codes for better compatibility of code format config: x86_64-kexec (https://download.01.org/0day-ci/archive/20241126/202411261838.mSwQ2Rni-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241126/202411261838.mSwQ2Rni-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411261838.mSwQ2Rni-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from net/ipv4/tcp_output.c:40: In file included from include/net/tcp.h:20: In file included from include/linux/tcp.h:17: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/x86/include/asm/cacheflush.h:5: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ net/ipv4/tcp_output.c:186:3: warning: result of comparison of constant -1 with expression of type 'u8' (aka 'unsigned char') is always false [-Wtautological-constant-out-of-range-compare] 186 | NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 187 | tp->compressed_ack); | ~~~~~~~~~~~~~~~~~~~ include/net/ip.h:302:41: note: expanded from macro 'NET_ADD_STATS' 302 | #define NET_ADD_STATS(net, field, adnd) SNMP_ADD_STATS((net)->mib.net_statistics, field, adnd) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/snmp.h:143:4: note: expanded from macro 'SNMP_ADD_STATS' 143 | this_cpu_add(mib->mibs[field], addend) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/percpu-defs.h:491:33: note: expanded from macro 'this_cpu_add' 491 | #define this_cpu_add(pcp, val) __pcpu_size_call(this_cpu_add_, pcp, val) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) <scratch space>:134:1: note: expanded from here 134 | this_cpu_add_8 | ^ arch/x86/include/asm/percpu.h:370:35: note: expanded from macro 'this_cpu_add_8' 370 | #define this_cpu_add_8(pcp, val) percpu_add_op(8, volatile, (pcp), val) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/include/asm/percpu.h:127:31: note: expanded from macro 'percpu_add_op' 127 | ((val) == 1 || (val) == -1)) ? \ | ~~~~~ ^ ~~ >> net/ipv4/tcp_output.c:1312:5: warning: variable 'tcp_hdr_rsrvd_4b' set but not used [-Wunused-but-set-variable] 1312 | u8 tcp_hdr_rsrvd_4b; | ^ 7 warnings generated. vim +/tcp_hdr_rsrvd_4b +1312 net/ipv4/tcp_output.c 1286 1287 /* This routine actually transmits TCP packets queued in by 1288 * tcp_do_sendmsg(). This is used by both the initial 1289 * transmission and possible later retransmissions. 1290 * All SKB's seen here are completely headerless. It is our 1291 * job to build the TCP header, and pass the packet down to 1292 * IP so it can do the same plus pass the packet off to the 1293 * device. 1294 * 1295 * We are working here with either a clone of the original 1296 * SKB, or a fresh unique copy made by the retransmit engine. 1297 */ 1298 static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, 1299 int clone_it, gfp_t gfp_mask, u32 rcv_nxt) 1300 { 1301 const struct inet_connection_sock *icsk = inet_csk(sk); 1302 struct inet_sock *inet; 1303 struct tcp_sock *tp; 1304 struct tcp_skb_cb *tcb; 1305 struct tcp_out_options opts; 1306 unsigned int tcp_options_size, tcp_header_size; 1307 struct sk_buff *oskb = NULL; 1308 struct tcp_md5sig_key *md5; 1309 struct tcphdr *th; 1310 u64 prior_wstamp; 1311 int err; > 1312 u8 tcp_hdr_rsrvd_4b; 1313 1314 BUG_ON(!skb || !tcp_skb_pcount(skb)); 1315 tcp_hdr_rsrvd_4b = try_to_update_skb_for_caqm(sk, skb); 1316 tp = tcp_sk(sk); 1317 prior_wstamp = tp->tcp_wstamp_ns; 1318 tp->tcp_wstamp_ns = max(tp->tcp_wstamp_ns, tp->tcp_clock_cache); 1319 skb_set_delivery_time(skb, tp->tcp_wstamp_ns, true); 1320 if (clone_it) { 1321 oskb = skb; 1322 1323 tcp_skb_tsorted_save(oskb) { 1324 if (unlikely(skb_cloned(oskb))) 1325 skb = pskb_copy(oskb, gfp_mask); 1326 else 1327 skb = skb_clone(oskb, gfp_mask); 1328 } tcp_skb_tsorted_restore(oskb); 1329 1330 if (unlikely(!skb)) 1331 return -ENOBUFS; 1332 /* retransmit skbs might have a non zero value in skb->dev 1333 * because skb->dev is aliased with skb->rbnode.rb_left 1334 */ 1335 skb->dev = NULL; 1336 } 1337 1338 inet = inet_sk(sk); 1339 tcb = TCP_SKB_CB(skb); 1340 memset(&opts, 0, sizeof(opts)); 1341 1342 if (unlikely(tcb->tcp_flags & TCPHDR_SYN)) { 1343 tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5); 1344 } else { 1345 tcp_options_size = tcp_established_options(sk, skb, &opts, 1346 &md5); 1347 /* Force a PSH flag on all (GSO) packets to expedite GRO flush 1348 * at receiver : This slightly improve GRO performance. 1349 * Note that we do not force the PSH flag for non GSO packets, 1350 * because they might be sent under high congestion events, 1351 * and in this case it is better to delay the delivery of 1-MSS 1352 * packets and thus the corresponding ACK packet that would 1353 * release the following packet. 1354 */ 1355 if (tcp_skb_pcount(skb) > 1) 1356 tcb->tcp_flags |= TCPHDR_PSH; 1357 } 1358 tcp_header_size = tcp_options_size + sizeof(struct tcphdr); 1359 1360 /* We set skb->ooo_okay to one if this packet can select 1361 * a different TX queue than prior packets of this flow, 1362 * to avoid self inflicted reorders. 1363 * The 'other' queue decision is based on current cpu number 1364 * if XPS is enabled, or sk->sk_txhash otherwise. 1365 * We can switch to another (and better) queue if: 1366 * 1) No packet with payload is in qdisc/device queues. 1367 * Delays in TX completion can defeat the test 1368 * even if packets were already sent. 1369 * 2) Or rtx queue is empty. 1370 * This mitigates above case if ACK packets for 1371 * all prior packets were already processed. 1372 */ 1373 skb->ooo_okay = sk_wmem_alloc_get(sk) < SKB_TRUESIZE(1) || 1374 tcp_rtx_queue_empty(sk); 1375 1376 /* If we had to use memory reserve to allocate this skb, 1377 * this might cause drops if packet is looped back : 1378 * Other socket might not have SOCK_MEMALLOC. 1379 * Packets not looped back do not care about pfmemalloc. 1380 */ 1381 skb->pfmemalloc = 0; 1382 1383 skb_push(skb, tcp_header_size); 1384 skb_reset_transport_header(skb); 1385 1386 skb_orphan(skb); 1387 skb->sk = sk; 1388 skb->destructor = skb_is_tcp_pure_ack(skb) ? __sock_wfree : tcp_wfree; 1389 refcount_add(skb->truesize, &sk->sk_wmem_alloc); 1390 1391 skb_set_dst_pending_confirm(skb, READ_ONCE(sk->sk_dst_pending_confirm)); 1392 1393 /* Build TCP header and checksum it. */ 1394 th = (struct tcphdr *)skb->data; 1395 th->source = inet->inet_sport; 1396 th->dest = inet->inet_dport; 1397 th->seq = htonl(tcb->seq); 1398 th->ack_seq = htonl(rcv_nxt); 1399 *(((__be16 *)th) + 6) = htons(((tcp_header_size >> 2) << 12) | 1400 tcb->tcp_flags); 1401 #ifdef CONFIG_ETH_CAQM 1402 if (static_branch_unlikely(&sysctl_caqm_enable)) 1403 *(((__be16 *)th) + 6) |= htons((tcp_hdr_rsrvd_4b & 0x0F) << 8); 1404 #endif 1405 1406 th->check = 0; 1407 th->urg_ptr = 0; 1408 1409 /* The urg_mode check is necessary during a below snd_una win probe */ 1410 if (unlikely(tcp_urg_mode(tp) && before(tcb->seq, tp->snd_up))) { 1411 if (before(tp->snd_up, tcb->seq + 0x10000)) { 1412 th->urg_ptr = htons(tp->snd_up - tcb->seq); 1413 th->urg = 1; 1414 } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) { 1415 th->urg_ptr = htons(0xFFFF); 1416 th->urg = 1; 1417 } 1418 } 1419 1420 skb_shinfo(skb)->gso_type = sk->sk_gso_type; 1421 if (likely(!(tcb->tcp_flags & TCPHDR_SYN))) { 1422 th->window = htons(tcp_select_window(sk)); 1423 tcp_ecn_send(sk, skb, th, tcp_header_size); 1424 } else { 1425 /* RFC1323: The window in SYN & SYN/ACK segments 1426 * is never scaled. 1427 */ 1428 th->window = htons(min(tp->rcv_wnd, 65535U)); 1429 } 1430 1431 tcp_options_write(th, tp, &opts); 1432 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] afs: Fix lock recursion
by Yifan Qiao 26 Nov '24

26 Nov '24

From: David Howells <dhowells(a)redhat.com> mainline inclusion from mainline-v6.12-rc5 commit 610a79ffea02102899a1373fe226d949944a7ed6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB67YK CVE: CVE-2024-53090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- afs_wake_up_async_call() can incur lock recursion. The problem is that it is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to take a ref on the afs_call struct in order to pass it to a work queue - but if the afs_call is already queued, we then have an extraneous ref that must be put... calling afs_put_call() may call back down into AF_RXRPC through rxrpc_kernel_shutdown_call(), however, which might try taking the ->notify_lock again. This case isn't very common, however, so defer it to a workqueue. The oops looks something like: BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646 lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0 CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: <TASK> dump_stack_lvl+0x47/0x70 do_raw_spin_lock+0x3c/0x90 rxrpc_kernel_shutdown_call+0x83/0xb0 afs_put_call+0xd7/0x180 rxrpc_notify_socket+0xa0/0x190 rxrpc_input_split_jumbo+0x198/0x1d0 rxrpc_input_data+0x14b/0x1e0 ? rxrpc_input_call_packet+0xc2/0x1f0 rxrpc_input_call_event+0xad/0x6b0 rxrpc_input_packet_on_conn+0x1e1/0x210 rxrpc_input_packet+0x3f2/0x4d0 rxrpc_io_thread+0x243/0x410 ? __pfx_rxrpc_io_thread+0x10/0x10 kthread+0xcf/0xe0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x24/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/1394602.1729162732@warthog.procyon.org.uk cc: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org cc: linux-fsdevel(a)vger.kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/afs/internal.h | 2 ++ fs/afs/rxrpc.c | 76 ++++++++++++++++++++++++++++++++++------------- 2 files changed, 57 insertions(+), 21 deletions(-) diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 8ce13fe4dd78..4c4b7007c91d 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -98,6 +98,7 @@ struct afs_call { wait_queue_head_t waitq; /* processes awaiting completion */ struct work_struct async_work; /* async I/O processor */ struct work_struct work; /* actual work processor */ + struct work_struct free_work; /* Deferred free processor */ struct rxrpc_call *rxcall; /* RxRPC call handle */ struct key *key; /* security for this call */ struct afs_net *net; /* The network namespace */ @@ -1247,6 +1248,7 @@ extern int __net_init afs_open_socket(struct afs_net *); extern void __net_exit afs_close_socket(struct afs_net *); extern void afs_charge_preallocation(struct work_struct *); extern void afs_put_call(struct afs_call *); +void afs_deferred_put_call(struct afs_call *call); extern void afs_make_call(struct afs_addr_cursor *, struct afs_call *, gfp_t); extern long afs_wait_for_call_to_complete(struct afs_call *, struct afs_addr_cursor *); extern struct afs_call *afs_alloc_flat_call(struct afs_net *, diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index 535d28b44bca..a870fdf22fd7 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -16,6 +16,7 @@ struct workqueue_struct *afs_async_calls; +static void afs_deferred_free_worker(struct work_struct *work); static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long); static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long); static void afs_process_async_call(struct work_struct *); @@ -147,6 +148,7 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, call->debug_id = atomic_inc_return(&rxrpc_debug_id); atomic_set(&call->usage, 1); INIT_WORK(&call->async_work, afs_process_async_call); + INIT_WORK(&call->free_work, afs_deferred_free_worker); init_waitqueue_head(&call->waitq); spin_lock_init(&call->state_lock); call->iter = &call->def_iter; @@ -157,6 +159,34 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, return call; } +static void afs_free_call(struct afs_call *call) +{ + struct afs_net *net = call->net; + int o; + + ASSERT(!work_pending(&call->async_work)); + + if (call->rxcall) { + rxrpc_kernel_end_call(net->socket, call->rxcall); + call->rxcall = NULL; + } + if (call->type->destructor) + call->type->destructor(call); + + afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); + afs_put_addrlist(call->alist); + kfree(call->request); + + o = atomic_read(&net->nr_outstanding_calls); + trace_afs_call(call, afs_call_trace_free, 0, o, + __builtin_return_address(0)); + kfree(call); + + o = atomic_dec_return(&net->nr_outstanding_calls); + if (o == 0) + wake_up_var(&net->nr_outstanding_calls); +} + /* * Dispose of a reference on a call. */ @@ -170,29 +200,32 @@ void afs_put_call(struct afs_call *call) __builtin_return_address(0)); ASSERTCMP(n, >=, 0); - if (n == 0) { - ASSERT(!work_pending(&call->async_work)); - ASSERT(call->type->name != NULL); + if (n == 0) + afs_free_call(call); +} - if (call->rxcall) { - rxrpc_kernel_end_call(net->socket, call->rxcall); - call->rxcall = NULL; - } - if (call->type->destructor) - call->type->destructor(call); +static void afs_deferred_free_worker(struct work_struct *work) +{ + struct afs_call *call = container_of(work, struct afs_call, free_work); - afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); - afs_put_addrlist(call->alist); - kfree(call->request); + afs_free_call(call); +} - trace_afs_call(call, afs_call_trace_free, 0, o, - __builtin_return_address(0)); - kfree(call); +/* + * Dispose of a reference on a call, deferring the cleanup to a workqueue + * to avoid lock recursion. + */ +void afs_deferred_put_call(struct afs_call *call) +{ + struct afs_net *net = call->net; + int n = atomic_dec_return(&call->usage); + int o = atomic_read(&net->nr_outstanding_calls); - o = atomic_dec_return(&net->nr_outstanding_calls); - if (o == 0) - wake_up_var(&net->nr_outstanding_calls); - } + trace_afs_call(call, afs_call_trace_put, n, o, + __builtin_return_address(0)); + ASSERTCMP(n, >=, 0); + if (n == 0) + schedule_work(&call->free_work); } static struct afs_call *afs_get_call(struct afs_call *call, @@ -692,7 +725,8 @@ static void afs_wake_up_call_waiter(struct sock *sk, struct rxrpc_call *rxcall, } /* - * wake up an asynchronous call + * Wake up an asynchronous call. The caller is holding the call notify + * spinlock around this, so we can't call afs_put_call(). */ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, unsigned long call_user_ID) @@ -710,7 +744,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, __builtin_return_address(0)); if (!queue_work(afs_async_calls, &call->async_work)) - afs_put_call(call); + afs_deferred_put_call(call); } } -- 2.39.2

2 1

[PATCH OLK-5.10] afs: Fix lock recursion
by Yifan Qiao 26 Nov '24

26 Nov '24

From: David Howells <dhowells(a)redhat.com> mainline inclusion from mainline-v6.12-rc5 commit 610a79ffea02102899a1373fe226d949944a7ed6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB67YK CVE: CVE-2024-53090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- afs_wake_up_async_call() can incur lock recursion. The problem is that it is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to take a ref on the afs_call struct in order to pass it to a work queue - but if the afs_call is already queued, we then have an extraneous ref that must be put... calling afs_put_call() may call back down into AF_RXRPC through rxrpc_kernel_shutdown_call(), however, which might try taking the ->notify_lock again. This case isn't very common, however, so defer it to a workqueue. The oops looks something like: BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646 lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0 CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: <TASK> dump_stack_lvl+0x47/0x70 do_raw_spin_lock+0x3c/0x90 rxrpc_kernel_shutdown_call+0x83/0xb0 afs_put_call+0xd7/0x180 rxrpc_notify_socket+0xa0/0x190 rxrpc_input_split_jumbo+0x198/0x1d0 rxrpc_input_data+0x14b/0x1e0 ? rxrpc_input_call_packet+0xc2/0x1f0 rxrpc_input_call_event+0xad/0x6b0 rxrpc_input_packet_on_conn+0x1e1/0x210 rxrpc_input_packet+0x3f2/0x4d0 rxrpc_io_thread+0x243/0x410 ? __pfx_rxrpc_io_thread+0x10/0x10 kthread+0xcf/0xe0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x24/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/1394602.1729162732@warthog.procyon.org.uk cc: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org cc: linux-fsdevel(a)vger.kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/afs/internal.h | 2 ++ fs/afs/rxrpc.c | 76 ++++++++++++++++++++++++++++++++++------------- 2 files changed, 57 insertions(+), 21 deletions(-) diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 94d544fc3353..3f17b92361b5 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -98,6 +98,7 @@ struct afs_call { wait_queue_head_t waitq; /* processes awaiting completion */ struct work_struct async_work; /* async I/O processor */ struct work_struct work; /* actual work processor */ + struct work_struct free_work; /* Deferred free processor */ struct rxrpc_call *rxcall; /* RxRPC call handle */ struct key *key; /* security for this call */ struct afs_net *net; /* The network namespace */ @@ -1248,6 +1249,7 @@ extern int __net_init afs_open_socket(struct afs_net *); extern void __net_exit afs_close_socket(struct afs_net *); extern void afs_charge_preallocation(struct work_struct *); extern void afs_put_call(struct afs_call *); +void afs_deferred_put_call(struct afs_call *call); extern void afs_make_call(struct afs_addr_cursor *, struct afs_call *, gfp_t); extern long afs_wait_for_call_to_complete(struct afs_call *, struct afs_addr_cursor *); extern struct afs_call *afs_alloc_flat_call(struct afs_net *, diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index 1820b53657a6..a6f27900b082 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -16,6 +16,7 @@ struct workqueue_struct *afs_async_calls; +static void afs_deferred_free_worker(struct work_struct *work); static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long); static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long); static void afs_process_async_call(struct work_struct *); @@ -147,6 +148,7 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, call->debug_id = atomic_inc_return(&rxrpc_debug_id); atomic_set(&call->usage, 1); INIT_WORK(&call->async_work, afs_process_async_call); + INIT_WORK(&call->free_work, afs_deferred_free_worker); init_waitqueue_head(&call->waitq); spin_lock_init(&call->state_lock); call->iter = &call->def_iter; @@ -157,6 +159,34 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, return call; } +static void afs_free_call(struct afs_call *call) +{ + struct afs_net *net = call->net; + int o; + + ASSERT(!work_pending(&call->async_work)); + + if (call->rxcall) { + rxrpc_kernel_end_call(net->socket, call->rxcall); + call->rxcall = NULL; + } + if (call->type->destructor) + call->type->destructor(call); + + afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); + afs_put_addrlist(call->alist); + kfree(call->request); + + o = atomic_read(&net->nr_outstanding_calls); + trace_afs_call(call, afs_call_trace_free, 0, o, + __builtin_return_address(0)); + kfree(call); + + o = atomic_dec_return(&net->nr_outstanding_calls); + if (o == 0) + wake_up_var(&net->nr_outstanding_calls); +} + /* * Dispose of a reference on a call. */ @@ -170,29 +200,32 @@ void afs_put_call(struct afs_call *call) __builtin_return_address(0)); ASSERTCMP(n, >=, 0); - if (n == 0) { - ASSERT(!work_pending(&call->async_work)); - ASSERT(call->type->name != NULL); + if (n == 0) + afs_free_call(call); +} - if (call->rxcall) { - rxrpc_kernel_end_call(net->socket, call->rxcall); - call->rxcall = NULL; - } - if (call->type->destructor) - call->type->destructor(call); +static void afs_deferred_free_worker(struct work_struct *work) +{ + struct afs_call *call = container_of(work, struct afs_call, free_work); - afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); - afs_put_addrlist(call->alist); - kfree(call->request); + afs_free_call(call); +} - trace_afs_call(call, afs_call_trace_free, 0, o, - __builtin_return_address(0)); - kfree(call); +/* + * Dispose of a reference on a call, deferring the cleanup to a workqueue + * to avoid lock recursion. + */ +void afs_deferred_put_call(struct afs_call *call) +{ + struct afs_net *net = call->net; + int n = atomic_dec_return(&call->usage); + int o = atomic_read(&net->nr_outstanding_calls); - o = atomic_dec_return(&net->nr_outstanding_calls); - if (o == 0) - wake_up_var(&net->nr_outstanding_calls); - } + trace_afs_call(call, afs_call_trace_put, n, o, + __builtin_return_address(0)); + ASSERTCMP(n, >=, 0); + if (n == 0) + schedule_work(&call->free_work); } static struct afs_call *afs_get_call(struct afs_call *call, @@ -692,7 +725,8 @@ static void afs_wake_up_call_waiter(struct sock *sk, struct rxrpc_call *rxcall, } /* - * wake up an asynchronous call + * Wake up an asynchronous call. The caller is holding the call notify + * spinlock around this, so we can't call afs_put_call(). */ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, unsigned long call_user_ID) @@ -710,7 +744,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, __builtin_return_address(0)); if (!queue_work(afs_async_calls, &call->async_work)) - afs_put_call(call); + afs_deferred_put_call(call); } } -- 2.39.2

2 1