April 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ext4: Validate inode pa before using preallocation blocks
by Zhihao Cheng 01 Apr '24

01 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97HJA CVE: NA -------------------------------- In ext4 continue & no-journal mode, physical blocks could be allocated more than once (caused by writing extent entries failed & reclaiming extent cache) in preallocation process, which could trigger a BUG_ON (pa->pa_free < len) in ext4_mb_use_inode_pa(). kernel BUG at fs/ext4/mballoc.c:4681! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 97 Comm: kworker/u8:3 Not tainted 6.8.0-rc7 RIP: 0010:ext4_mb_use_inode_pa+0x1b6/0x1e0 Call Trace: ext4_mb_use_preallocated.constprop.0+0x19e/0x540 ext4_mb_new_blocks+0x220/0x1f30 ext4_ext_map_blocks+0xf3c/0x2900 ext4_map_blocks+0x264/0xa40 ext4_do_writepages+0xb15/0x1400 do_writepages+0x8c/0x260 writeback_sb_inodes+0x224/0x720 wb_writeback+0xd8/0x580 wb_workfn+0x148/0x820 Details are shown as following: 0. Given a file with i_size=4096 with one mapped block 1. Write block no 1, blocks 1~3 are preallocated. ext4_ext_map_blocks ext4_mb_normalize_request size = 16 * 1024 size = end - start // Allocate 3 blocks (bs = 4096) ext4_mb_regular_allocator ext4_mb_regular_allocator ext4_mb_regular_allocator ext4_mb_use_inode_pa pa->pa_free -= len // 3 - 1 = 2 2. Extent buffer head is written failed, es cache and buffer head are reclaimed. 3. Write blocks 1~3 ext4_ext_map_blocks newex.ee_len = 3 ext4_ext_check_overlap // Find nothing, there should have been block 1 allocated = map->m_len // 3 ext4_mb_new_blocks ext4_mb_use_preallocated ext4_mb_use_inode_pa BUG_ON(pa->pa_free < len) // 2 < 3! Fix it by adding validation checking for inode pa. If invalid pa is detected, stop using inode preallocation, drop invalid pa to avoid it being used again, mark group block bitmap as corrupted to avoid allocating from the erroneous group. Fetch a reproducer in Link. Cc: stable(a)vger.kernel.org Fixes: c9de560ded61f ("ext4: Add multi block allocator for ext4") Link: https://bugzilla.kernel.org/show_bug.cgi?id=218576 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> --- fs/ext4/mballoc.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index a40990da0b62..c07289164c12 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -356,6 +356,8 @@ static void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap, ext4_group_t group); static void ext4_mb_generate_from_freelist(struct super_block *sb, void *bitmap, ext4_group_t group); +static void ext4_mb_put_pa(struct ext4_allocation_context *ac, + struct super_block *sb, struct ext4_prealloc_space *pa); static inline void *mb_correct_addr_and_bit(int *bit, void *addr) { @@ -3364,6 +3366,47 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac) pa->pa_free += ac->ac_b_ex.fe_len; } +/* + * check if found pa is valid + */ +static bool ext4_mb_pa_is_valid(struct ext4_allocation_context *ac, + struct ext4_prealloc_space *pa) +{ + struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb); + ext4_fsblk_t start; + ext4_fsblk_t end; + int len; + + start = pa->pa_pstart + (ac->ac_o_ex.fe_logical - pa->pa_lstart); + end = min(pa->pa_pstart + EXT4_C2B(sbi, pa->pa_len), + start + EXT4_C2B(sbi, ac->ac_o_ex.fe_len)); + len = EXT4_NUM_B2C(sbi, end - start); + + if (unlikely(start < pa->pa_pstart)) { + ext4_msg(ac->ac_sb, KERN_ERR, + "invalid pa, start(%llu) < pa_pstart(%llu)", + start, pa->pa_pstart); + return false; + } + if (unlikely(end > pa->pa_pstart + EXT4_C2B(sbi, pa->pa_len))) { + ext4_msg(ac->ac_sb, KERN_ERR, + "invalid pa, end(%llu) > pa_pstart(%llu) + pa_len(%d)", + end, pa->pa_pstart, EXT4_C2B(sbi, pa->pa_len)); + return false; + } + if (unlikely(pa->pa_free < len)) { + ext4_msg(ac->ac_sb, KERN_ERR, + "invalid pa, pa_free(%d) < len(%d)", pa->pa_free, len); + return false; + } + if (unlikely(len <= 0)) { + ext4_msg(ac->ac_sb, KERN_ERR, "invalid pa, len(%d) <= 0", len); + return false; + } + + return true; +} + /* * use blocks preallocated to inode */ @@ -3483,6 +3526,23 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac) /* found preallocated blocks, use them */ spin_lock(&pa->pa_lock); + if (unlikely(!ext4_mb_pa_is_valid(ac, pa))) { + ext4_group_t group; + + pa->pa_free = 0; + atomic_inc(&pa->pa_count); + spin_unlock(&pa->pa_lock); + rcu_read_unlock(); + ext4_mb_put_pa(ac, ac->ac_sb, pa); + group = ext4_get_group_number(ac->ac_sb, pa->pa_pstart); + ext4_lock_group(ac->ac_sb, group); + ext4_mark_group_bitmap_corrupted(ac->ac_sb, group, + EXT4_GROUP_INFO_BBITMAP_CORRUPT); + ext4_unlock_group(ac->ac_sb, group); + ext4_error(ac->ac_sb, "drop pa and mark group %u block bitmap corrupted", + group); + goto try_group_pa; + } if (pa->pa_deleted == 0 && pa->pa_free) { atomic_inc(&pa->pa_count); ext4_mb_use_inode_pa(ac, pa); @@ -3495,6 +3555,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac) } rcu_read_unlock(); +try_group_pa: /* can we use group allocation? */ if (!(ac->ac_flags & EXT4_MB_HINT_GROUP_ALLOC)) return 0; -- 2.31.1

2 1

[PATCH OLK-5.10 0/7] ext4: dio: Put endio under irq context for overwrite
by Zhihao Cheng 01 Apr '24

01 Apr '24

Christoph Hellwig (2): iomap: rename the flags variable in __iomap_dio_rw iomap: pass a flags argument to iomap_dio_rw Jens Axboe (3): iomap: cleanup up iomap_dio_bio_end_io() iomap: use an unsigned type for IOMAP_DIO_* defines iomap: add IOMAP_DIO_INLINE_COMP Zhihao Cheng (2): iomap: Enable IOMAP_DIO_INLINE_COMP in write paths ext4: Optimize endio process for DIO overwrites fs/btrfs/inode.c | 4 +-- fs/ext4/file.c | 14 +++++--- fs/gfs2/file.c | 7 ++-- fs/iomap/direct-io.c | 84 ++++++++++++++++++++++++++++--------------- fs/xfs/xfs_file.c | 5 ++- fs/zonefs/super.c | 4 +-- include/linux/iomap.h | 10 ++++-- 7 files changed, 81 insertions(+), 47 deletions(-) -- 2.31.1

2 8

[openeuler:openEuler-1.0-LTS 16561/22014] mm/pin_mem.c:34:14: sparse: sparse: symbol 'max_pin_pid_num' was not declared. Should it be static?
by kernel test robot 01 Apr '24

01 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ec7a5c4d5af617f2a56393232f3f4c10f120bfd6 commit: 1a378b87531ea80e7847bf0105adedff28a73080 [16561/22014] mm: add pin memory method for checkpoint add restore config: arm64-randconfig-r111-20240331 (https://download.01.org/0day-ci/archive/20240401/202404011908.ylzPInkY-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240401/202404011908.ylzPInkY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404011908.ylzPInkY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/pin_mem.c:34:14: sparse: sparse: symbol 'max_pin_pid_num' was not declared. Should it be static? >> mm/pin_mem.c:35:15: sparse: sparse: symbol 'redirect_space_size' was not declared. Should it be static? >> mm/pin_mem.c:171:6: sparse: sparse: symbol 'reserve_page_from_buddy' was not declared. Should it be static? >> mm/pin_mem.c:254:6: sparse: sparse: symbol 'free_user_map_pages' was not declared. Should it be static? >> mm/pin_mem.c:311:6: sparse: sparse: symbol 'check_redirect_end_valid' was not declared. Should it be static? >> mm/pin_mem.c:392:5: sparse: sparse: symbol 'calculate_pin_mem_digest' was not declared. Should it be static? >> mm/pin_mem.c:481:5: sparse: sparse: symbol 'collect_pmd_huge_pages' was not declared. Should it be static? >> mm/pin_mem.c:544:5: sparse: sparse: symbol 'collect_normal_pages' was not declared. Should it be static? >> mm/pin_mem.c:610:6: sparse: sparse: symbol 'free_pin_pages' was not declared. Should it be static? >> mm/pin_mem.c:770:12: sparse: sparse: symbol 'remap_normal_pages' was not declared. Should it be static? >> mm/pin_mem.c:857:12: sparse: sparse: symbol 'remap_huge_pmd_pages' was not declared. Should it be static? >> mm/pin_mem.c:844:63: sparse: sparse: not addressable mm/pin_mem.c:846:63: sparse: sparse: not addressable mm/pin_mem.c:848:71: sparse: sparse: not addressable mm/pin_mem.c:851:65: sparse: sparse: not addressable mm/pin_mem.c:171:6: warning: no previous prototype for 'reserve_page_from_buddy' [-Wmissing-prototypes] 171 | void reserve_page_from_buddy(unsigned long nr_pages, struct page *page) | ^~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:254:6: warning: no previous prototype for 'free_user_map_pages' [-Wmissing-prototypes] 254 | void free_user_map_pages(unsigned int pid_index, unsigned int entry_index, unsigned int page_index) | ^~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:311:6: warning: no previous prototype for 'check_redirect_end_valid' [-Wmissing-prototypes] 311 | bool check_redirect_end_valid(struct redirect_info *redirect_start, | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:392:5: warning: no previous prototype for 'calculate_pin_mem_digest' [-Wmissing-prototypes] 392 | int calculate_pin_mem_digest(struct pin_mem_dump_info *pmdi, char *digest) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:481:5: warning: no previous prototype for 'collect_pmd_huge_pages' [-Wmissing-prototypes] 481 | int collect_pmd_huge_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:544:5: warning: no previous prototype for 'collect_normal_pages' [-Wmissing-prototypes] 544 | int collect_normal_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'collect_normal_pages': mm/pin_mem.c:549:26: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 549 | unsigned long i, nr_pages; | ^~~~~~~~ mm/pin_mem.c: At top level: mm/pin_mem.c:610:6: warning: no previous prototype for 'free_pin_pages' [-Wmissing-prototypes] 610 | void free_pin_pages(struct page_map_entry *pme) | ^~~~~~~~~~~~~~ mm/pin_mem.c:770:12: warning: no previous prototype for 'remap_normal_pages' [-Wmissing-prototypes] 770 | vm_fault_t remap_normal_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'get_hugepage_gfpmask': mm/pin_mem.c:844:63: error: lvalue required as unary '&' operand 844 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:846:63: error: lvalue required as unary '&' operand 846 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:848:71: error: lvalue required as unary '&' operand 848 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:851:65: error: lvalue required as unary '&' operand 851 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c: At top level: mm/pin_mem.c:857:12: warning: no previous prototype for 'remap_huge_pmd_pages' [-Wmissing-prototypes] 857 | vm_fault_t remap_huge_pmd_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~~~ vim +/max_pin_pid_num +34 mm/pin_mem.c 33 > 34 unsigned int max_pin_pid_num __read_mostly; > 35 unsigned long redirect_space_size __read_mostly; 36 static unsigned long redirect_space_start; 37 static void *pin_mem_pagewalk; 38 static unsigned long *pagemap_buffer; 39 static int reserve_user_map_pages_fail; 40 41 static int __init setup_max_pin_pid_num(char *str) 42 { 43 int ret; 44 45 if (!str) 46 return 0; 47 48 ret = kstrtouint(str, 10, &max_pin_pid_num); 49 if (ret) { 50 pr_warn("Unable to parse max pin pid num.\n"); 51 } else { 52 if (max_pin_pid_num > MAX_PIN_PID_NUM) { 53 max_pin_pid_num = 0; 54 pr_warn("Input max_pin_pid_num is too large.\n"); 55 } 56 } 57 return ret; 58 } 59 early_param("max_pin_pid_num", setup_max_pin_pid_num); 60 61 static int __init setup_redirect_space_size(char *str) 62 { 63 if (!str) 64 return 0; 65 66 redirect_space_size = memparse(str, NULL); 67 if (!redirect_space_size) { 68 pr_warn("Unable to parse redirect space size, use the default value.\n"); 69 redirect_space_size = DEFAULT_REDIRECT_SPACE_SIZE; 70 } 71 return 0; 72 } 73 early_param("redirect_space_size", setup_redirect_space_size); 74 75 struct page_map_info *create_page_map_info(int pid) 76 { 77 struct page_map_info *new; 78 79 if (!user_space_reserve_start) 80 return NULL; 81 82 if (pin_pid_num >= max_pin_pid_num) { 83 pr_warn("Pin pid num too large than max_pin_pid_num, fail create: %d!", pid); 84 return NULL; 85 } 86 new = (struct page_map_info *)(user_space_reserve_start + pin_pid_num); 87 new->pid = pid; 88 new->pme = NULL; 89 new->entry_num = 0; 90 new->pid_reserved = false; 91 new->disable_free_page = false; 92 (*pin_pid_num_addr)++; 93 pin_pid_num++; 94 return new; 95 } 96 EXPORT_SYMBOL_GPL(create_page_map_info); 97 98 struct page_map_info *get_page_map_info(int pid) 99 { 100 int i; 101 102 if (!user_space_reserve_start) 103 return NULL; 104 105 for (i = 0; i < pin_pid_num; i++) { 106 if (user_space_reserve_start[i].pid == pid) 107 return &(user_space_reserve_start[i]); 108 } 109 return NULL; 110 } 111 EXPORT_SYMBOL_GPL(get_page_map_info); 112 113 static struct page *find_head_page(struct page *page) 114 { 115 struct page *p = page; 116 117 while (!PageBuddy(p)) { 118 if (PageLRU(p)) 119 return NULL; 120 p--; 121 } 122 return p; 123 } 124 125 static void spilt_page_area_left(struct zone *zone, struct free_area *area, struct page *page, 126 unsigned long size, int order) 127 { 128 unsigned long cur_size = 1 << order; 129 unsigned long total_size = 0; 130 131 while (size && cur_size > size) { 132 cur_size >>= 1; 133 order--; 134 area--; 135 if (cur_size <= size) { 136 list_add(&page[total_size].lru, &area->free_list[MIGRATE_MOVABLE]); 137 atomic_set(&(page[total_size]._mapcount), PAGE_BUDDY_MAPCOUNT_VALUE); 138 set_page_private(&page[total_size], order); 139 set_pageblock_migratetype(&page[total_size], MIGRATE_MOVABLE); 140 area->nr_free++; 141 total_size += cur_size; 142 size -= cur_size; 143 } 144 } 145 } 146 147 static void spilt_page_area_right(struct zone *zone, struct free_area *area, struct page *page, 148 unsigned long size, int order) 149 { 150 unsigned long cur_size = 1 << order; 151 struct page *right_page, *head_page; 152 153 right_page = page + size; 154 while (size && cur_size > size) { 155 cur_size >>= 1; 156 order--; 157 area--; 158 if (cur_size <= size) { 159 head_page = right_page - cur_size; 160 list_add(&head_page->lru, &area->free_list[MIGRATE_MOVABLE]); 161 atomic_set(&(head_page->_mapcount), PAGE_BUDDY_MAPCOUNT_VALUE); 162 set_page_private(head_page, order); 163 set_pageblock_migratetype(head_page, MIGRATE_MOVABLE); 164 area->nr_free++; 165 size -= cur_size; 166 right_page = head_page; 167 } 168 } 169 } 170 > 171 void reserve_page_from_buddy(unsigned long nr_pages, struct page *page) 172 { 173 unsigned int current_order; 174 struct page *page_end; 175 struct free_area *area; 176 struct zone *zone; 177 struct page *head_page; 178 179 head_page = find_head_page(page); 180 if (!head_page) { 181 pr_warn("Find page head fail."); 182 return; 183 } 184 185 current_order = head_page->private; 186 page_end = head_page + (1 << current_order); 187 zone = page_zone(head_page); 188 area = &(zone->free_area[current_order]); 189 list_del(&head_page->lru); 190 atomic_set(&head_page->_mapcount, -1); 191 set_page_private(head_page, 0); 192 area->nr_free--; 193 194 if (head_page != page) 195 spilt_page_area_left(zone, area, head_page, 196 (unsigned long)(page - head_page), current_order); 197 page = page + nr_pages; 198 if (page < page_end) { 199 spilt_page_area_right(zone, area, page, 200 (unsigned long)(page_end - page), current_order); 201 } else if (page > page_end) { 202 pr_warn("Find page end smaller than page."); 203 } 204 } 205 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] sr9800: Add check for usbnet_get_endpoints
by felix 01 Apr '24

01 Apr '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v4.19.311 commit 424eba06ed405d557077339edb19ce0ebe39e7c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9C6FA CVE: CVE-2024-26651 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ] Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support") Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/net/usb/sr9800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c index 8f8c9ede88c2..a5ff7df10505 100644 --- a/drivers/net/usb/sr9800.c +++ b/drivers/net/usb/sr9800.c @@ -737,7 +737,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf) data->eeprom_len = SR9800_EEPROM_LEN; - usbnet_get_endpoints(dev, intf); + ret = usbnet_get_endpoints(dev, intf); + if (ret) + goto out; /* LED Setting Rule : * AABB:CCDD -- 2.34.1

2 1

[PATCH OLK-6.6] sr9800: Add check for usbnet_get_endpoints
by felix 01 Apr '24

01 Apr '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v6.6.23 commit e39a3a14eafcf17f03c037290b78c8f483529028 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9C6FA CVE: CVE-2024-26651 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ] Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support") Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/net/usb/sr9800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c index f5e19f3ef6cd..4de514482183 100644 --- a/drivers/net/usb/sr9800.c +++ b/drivers/net/usb/sr9800.c @@ -737,7 +737,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf) data->eeprom_len = SR9800_EEPROM_LEN; - usbnet_get_endpoints(dev, intf); + ret = usbnet_get_endpoints(dev, intf); + if (ret) + goto out; /* LED Setting Rule : * AABB:CCDD -- 2.34.1

2 1

[PATCH OLK-5.10] sr9800: Add check for usbnet_get_endpoints
by felix 01 Apr '24

01 Apr '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v5.10.214 commit 6b4a39acafaf0186ed8e97c16e0aa6fca0e52009 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9C6FA CVE: CVE-2024-26651 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ] Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support") Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/net/usb/sr9800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c index 681e0def6356..a5332e99102a 100644 --- a/drivers/net/usb/sr9800.c +++ b/drivers/net/usb/sr9800.c @@ -736,7 +736,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf) data->eeprom_len = SR9800_EEPROM_LEN; - usbnet_get_endpoints(dev, intf); + ret = usbnet_get_endpoints(dev, intf); + if (ret) + goto out; /* LED Setting Rule : * AABB:CCDD -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tipc: wait and exit until all work queues are done
by Ziyang Xuan 01 Apr '24

01 Apr '24

From: Xin Long <lucien.xin(a)gmail.com> mainline inclusion from mainline-v5.13-rc4 commit 04c26faa51d1e2fe71cf13c45791f5174c37f986 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHRY CVE: CVE-2021-47163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On some host, a crash could be triggered simply by repeating these commands several times: # modprobe tipc # tipc bearer enable media udp name UDP1 localip 127.0.0.1 # rmmod tipc [] BUG: unable to handle kernel paging request at ffffffffc096bb00 [] Workqueue: events 0xffffffffc096bb00 [] Call Trace: [] ? process_one_work+0x1a7/0x360 [] ? worker_thread+0x30/0x390 [] ? create_worker+0x1a0/0x1a0 [] ? kthread+0x116/0x130 [] ? kthread_flush_work_fn+0x10/0x10 [] ? ret_from_fork+0x35/0x40 When removing the TIPC module, the UDP tunnel sock will be delayed to release in a work queue as sock_release() can't be done in rtnl_lock(). If the work queue is schedule to run after the TIPC module is removed, kernel will crash as the work queue function cleanup_beareri() code no longer exists when trying to invoke it. To fix it, this patch introduce a member wq_count in tipc_net to track the numbers of work queues in schedule, and wait and exit until all work queues are done in tipc_exit_net(). Fixes: d0f91938bede ("tipc: add ip/udp media type") Reported-by: Shuang Li <shuali(a)redhat.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Jon Maloy <jmaloy(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/tipc/core.c net/tipc/core.h net/tipc/udp_media.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/tipc/core.c | 5 +++++ net/tipc/core.h | 3 +++ net/tipc/udp_media.c | 2 ++ 3 files changed, 10 insertions(+) diff --git a/net/tipc/core.c b/net/tipc/core.c index 49bb9fc0aa06..7b61e1650cb0 100644 --- a/net/tipc/core.c +++ b/net/tipc/core.c @@ -92,10 +92,15 @@ static int __net_init tipc_init_net(struct net *net) static void __net_exit tipc_exit_net(struct net *net) { + struct tipc_net *tn = tipc_net(net); + tipc_net_stop(net); tipc_bcast_stop(net); tipc_nametbl_stop(net); tipc_sk_rht_destroy(net); + + while (atomic_read(&tn->wq_count)) + cond_resched(); } static struct pernet_operations tipc_net_ops = { diff --git a/net/tipc/core.h b/net/tipc/core.h index 8020a6c360ff..3abbdbffd460 100644 --- a/net/tipc/core.h +++ b/net/tipc/core.h @@ -122,6 +122,9 @@ struct tipc_net { /* Topology subscription server */ struct tipc_topsrv *topsrv; atomic_t subscription_count; + + /* The numbers of work queues in schedule */ + atomic_t wq_count; }; static inline struct tipc_net *tipc_net(struct net *net) diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index 1d6235479706..efe822d3bb28 100644 --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -771,6 +771,7 @@ static void cleanup_bearer(struct work_struct *work) kfree_rcu(rcast, rcu); } + atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); if (ub->ubsock) udp_tunnel_sock_release(ub->ubsock); synchronize_net(); @@ -792,6 +793,7 @@ static void tipc_udp_disable(struct tipc_bearer *b) RCU_INIT_POINTER(ub->bearer, NULL); /* sock_release need to be done outside of rtnl lock */ + atomic_inc(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); INIT_WORK(&ub->work, cleanup_bearer); schedule_work(&ub->work); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFS: Fix an Oopsable condition in __nfs_pageio_add_request()
by ZhaoLong Wang 01 Apr '24

01 Apr '24

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.13-rc4 commit 56517ab958b7c11030e626250c00b9b1a24b41eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHTI CVE: CVE-2021-47167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure that nfs_pageio_error_cleanup() resets the mirror array contents, so that the structure reflects the fact that it is now empty. Also change the test in nfs_pageio_do_add_request() to be more robust by checking whether or not the list is empty rather than relying on the value of pg_count. Fixes: a7d42ddb3099 ("nfs: add mirroring support to pgio layer") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/pagelist.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/pagelist.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c index a9e1bcdd9394..c5f862834b16 100644 --- a/fs/nfs/pagelist.c +++ b/fs/nfs/pagelist.c @@ -964,15 +964,17 @@ static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc, struct nfs_page *prev = NULL; - if (mirror->pg_count != 0) { - prev = nfs_list_entry(mirror->pg_list.prev); - } else { + if (list_empty(&mirror->pg_list)) { if (desc->pg_ops->pg_init) desc->pg_ops->pg_init(desc, req); if (desc->pg_error < 0) return 0; mirror->pg_base = req->wb_pgbase; - } + mirror->pg_count = 0; + mirror->pg_recoalesce = 0; + } else + prev = nfs_list_entry(mirror->pg_list.prev); + if (!nfs_can_coalesce_requests(prev, req, desc)) return 0; nfs_list_move_request(req, &mirror->pg_list); -- 2.39.2

2 1

[PATCH OLK-6.6 v2 0/4] Disable OLK-6.6 configs
by Luo Gengkun 01 Apr '24

01 Apr '24

v1->v2: Remove the disable of CONFIG_PERF_EVENTS_AMD_UNCORE Change the way of disable configs Luo Gengkun (4): x86: configs: Disable CRASH_HOTPLUG x86: configs: Disable X86_KERNEL_IBT x86: configs: Disable PROBE_EVENTS_BTF_ARGS arm64: configs: Disable PROBE_EVENTS_BTF_ARGS arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] tipc: skb_linearize the head skb when reassembling msgs
by Ziyang Xuan 01 Apr '24

01 Apr '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.193 commit 4b1761898861117c97066aea6c58f68a7787f0bf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHF9 CVE: CVE-2021-47162 -------------------------------- commit b7df21cf1b79ab7026f545e7bf837bd5750ac026 upstream. It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs. However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once. The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices: [] kernel BUG at net/core/skbuff.c:1970! [] Call Trace: [] skb_clone+0x4d/0xb0 [] macvlan_broadcast+0xd8/0x160 [macvlan] [] macvlan_process_broadcast+0x148/0x150 [macvlan] [] process_one_work+0x1a7/0x360 [] worker_thread+0x30/0x390 [] kernel BUG at mm/usercopy.c:102! [] Call Trace: [] __check_heap_object+0xd3/0x100 [] __check_object_size+0xff/0x16b [] simple_copy_to_iter+0x1c/0x30 [] __skb_datagram_iter+0x7d/0x310 [] __skb_datagram_iter+0x2a5/0x310 [] skb_copy_datagram_iter+0x3b/0x90 [] tipc_recvmsg+0x14a/0x3a0 [tipc] [] ____sys_recvmsg+0x91/0x150 [] ___sys_recvmsg+0x7b/0xc0 [] kernel BUG at mm/slub.c:305! [] Call Trace: [] <IRQ> [] kmem_cache_free+0x3ff/0x400 [] __netif_receive_skb_core+0x12c/0xc40 [] ? kmem_cache_alloc+0x12e/0x270 [] netif_receive_skb_internal+0x3d/0xb0 [] ? get_rx_page_info+0x8e/0xa0 [be2net] [] be_poll+0x6ef/0xd00 [be2net] [] ? irq_exit+0x4f/0x100 [] net_rx_action+0x149/0x3b0 ... This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time. Fixes: 45c8b7b175ce ("tipc: allow non-linear first fragment buffer") Reported-by: Li Shuang <shuali(a)redhat.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Jon Maloy <jmaloy(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/tipc/msg.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/net/tipc/msg.c b/net/tipc/msg.c index f04843ca8216..0ac270444974 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -141,18 +141,13 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (unlikely(head)) goto err; *buf = NULL; + if (skb_has_frag_list(frag) && __skb_linearize(frag)) + goto err; frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; head = *headbuf = frag; TIPC_SKB_CB(head)->tail = NULL; - if (skb_is_nonlinear(head)) { - skb_walk_frags(head, tail) { - TIPC_SKB_CB(head)->tail = tail; - } - } else { - skb_frag_list_init(head); - } return 0; } -- 2.25.1

2 1