April 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/5] Disable some OLK-6.6 configs
by Luo Gengkun 01 Apr '24

01 Apr '24

Luo Gengkun (4): x86: configs: Disable CRASH_HOTPLUG x86: configs: Disable X86_KERNEL_IBT x86: configs: Disable PROBE_EVENTS_BTF_ARGS arm64: configs: Disable PROBE_EVENTS_BTF_ARGS arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP2] arm64/mpam: support MPAM v0.1 version
by Zeng Heng 01 Apr '24

01 Apr '24

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I92AK4 CVE: NA ----------------------------- This supports MPAM v0.1 version for cpufeature detection, check [1] for details. [1] https://developer.arm.com/documentation/ddi0595/2021-12/ AArch64-Registers/ID-AA64PFR1-EL1--AArch64-Processor-Feature-Register-1?lang=en Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/cpufeature.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 57631fa553f6..df1b1b2fe178 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1294,6 +1294,17 @@ static bool has_cache_idc(const struct arm64_cpu_capabilities *entry, return ctr & BIT(CTR_IDC_SHIFT); } +#ifdef CONFIG_MPAM +static bool has_mpam(const struct arm64_cpu_capabilities *entry, int __unused) +{ + u64 pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1); + u64 pfr1 = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1); + + return cpuid_feature_extract_unsigned_field(pfr0, ID_AA64PFR0_MPAM_SHIFT) | + cpuid_feature_extract_unsigned_field(pfr1, ID_AA64PFR1_MPAMFRAC_SHIFT); +} +#endif + static void cpu_emulate_effective_ctr(const struct arm64_cpu_capabilities *__unused) { /* @@ -2004,11 +2015,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = { .desc = "ARM64 MPAM Extension Support", .capability = ARM64_HAS_MPAM, .type = ARM64_CPUCAP_SCOPE_SYSTEM, - .matches = has_cpuid_feature, - .sys_reg = SYS_ID_AA64PFR0_EL1, - .sign = FTR_UNSIGNED, - .field_pos = ID_AA64PFR0_MPAM_SHIFT, - .min_field_value = ID_AA64PFR0_MPAM, + .matches = has_mpam, }, #endif /* CONFIG_MPAM */ #ifdef CONFIG_ARM64_AMU_EXTN -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
by Liu Jian 01 Apr '24

01 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.199 commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP CVE: CVE-2023-52502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ] Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Fixes: 8f50020ed9b8 ("NFC: LLCP late binding") Reported-by: Sili Luo <rootlab(a)huawei.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willy Tarreau <w(a)1wt.eu> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/nfc/llcp_core.c --- net/nfc/llcp_core.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 5cc3d1629b7a..3a7d9d5bde46 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) { llcp_sock = tmp_sock; + sock_hold(&llcp_sock->sk); break; } } read_unlock(&local->sockets.lock); - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - return llcp_sock; } @@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len) static struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, - u8 *sn, size_t sn_len) + u8 *sn, size_t sn_len, + bool needref) { struct sock *sk; struct nfc_llcp_sock *llcp_sock, *tmp_sock; @@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) { llcp_sock = tmp_sock; + if (needref) + sock_hold(&llcp_sock->sk); break; } } @@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, * to this service name. */ if (nfc_llcp_sock_from_sn(local, sock->service_name, - sock->service_name_len) != NULL) { + sock->service_name_len, + false) != NULL) { mutex_unlock(&local->sdp_lock); return LLCP_SAP_MAX; @@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, u8 *sn, size_t sn_len) { - struct nfc_llcp_sock *llcp_sock; - - llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len); - - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - - return llcp_sock; + return nfc_llcp_sock_from_sn(local, sn, sn_len, true); } static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len) @@ -1303,7 +1294,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, } llcp_sock = nfc_llcp_sock_from_sn(local, service_name, - service_name_len); + service_name_len, + true); if (!llcp_sock) { sap = 0; goto add_snl; @@ -1323,6 +1315,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, if (sap == LLCP_SAP_MAX) { sap = 0; + nfc_llcp_sock_put(llcp_sock); goto add_snl; } @@ -1340,6 +1333,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, pr_debug("%p %d\n", llcp_sock, sap); + nfc_llcp_sock_put(llcp_sock); add_snl: sdp = nfc_llcp_build_sdres_tlv(tid, sap); if (sdp == NULL) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
by Liu Jian 01 Apr '24

01 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.199 commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP CVE: CVE-2023-52502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ] Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Fixes: 8f50020ed9b8 ("NFC: LLCP late binding") Reported-by: Sili Luo <rootlab(a)huawei.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willy Tarreau <w(a)1wt.eu> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/nfc/llcp_core.c --- net/nfc/llcp_core.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 7c07908198f9..65b0d07fa0f3 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -204,17 +204,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) { llcp_sock = tmp_sock; + sock_hold(&llcp_sock->sk); break; } } read_unlock(&local->sockets.lock); - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - return llcp_sock; } @@ -347,7 +343,8 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len) static struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, - u8 *sn, size_t sn_len) + u8 *sn, size_t sn_len, + bool needref) { struct sock *sk; struct nfc_llcp_sock *llcp_sock, *tmp_sock; @@ -383,6 +380,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) { llcp_sock = tmp_sock; + if (needref) + sock_hold(&llcp_sock->sk); break; } } @@ -424,7 +423,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, * to this service name. */ if (nfc_llcp_sock_from_sn(local, sock->service_name, - sock->service_name_len) != NULL) { + sock->service_name_len, + false) != NULL) { mutex_unlock(&local->sdp_lock); return LLCP_SAP_MAX; @@ -832,16 +832,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, u8 *sn, size_t sn_len) { - struct nfc_llcp_sock *llcp_sock; - - llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len); - - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - - return llcp_sock; + return nfc_llcp_sock_from_sn(local, sn, sn_len, true); } static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len) @@ -1302,7 +1293,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, } llcp_sock = nfc_llcp_sock_from_sn(local, service_name, - service_name_len); + service_name_len, + true); if (!llcp_sock) { sap = 0; goto add_snl; @@ -1322,6 +1314,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, if (sap == LLCP_SAP_MAX) { sap = 0; + nfc_llcp_sock_put(llcp_sock); goto add_snl; } @@ -1339,6 +1332,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, pr_debug("%p %d\n", llcp_sock, sap); + nfc_llcp_sock_put(llcp_sock); add_snl: sdp = nfc_llcp_build_sdres_tlv(tid, sap); if (sdp == NULL) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
by Liu Jian 01 Apr '24

01 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.199 commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP CVE: CVE-2023-52502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ] Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Fixes: 8f50020ed9b8 ("NFC: LLCP late binding") Reported-by: Sili Luo <rootlab(a)huawei.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willy Tarreau <w(a)1wt.eu> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/nfc/llcp_core.c --- net/nfc/llcp_core.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 7c07908198f9..65b0d07fa0f3 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -204,17 +204,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) { llcp_sock = tmp_sock; + sock_hold(&llcp_sock->sk); break; } } read_unlock(&local->sockets.lock); - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - return llcp_sock; } @@ -347,7 +343,8 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len) static struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, - u8 *sn, size_t sn_len) + u8 *sn, size_t sn_len, + bool needref) { struct sock *sk; struct nfc_llcp_sock *llcp_sock, *tmp_sock; @@ -383,6 +380,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) { llcp_sock = tmp_sock; + if (needref) + sock_hold(&llcp_sock->sk); break; } } @@ -424,7 +423,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, * to this service name. */ if (nfc_llcp_sock_from_sn(local, sock->service_name, - sock->service_name_len) != NULL) { + sock->service_name_len, + false) != NULL) { mutex_unlock(&local->sdp_lock); return LLCP_SAP_MAX; @@ -832,16 +832,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, u8 *sn, size_t sn_len) { - struct nfc_llcp_sock *llcp_sock; - - llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len); - - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - - return llcp_sock; + return nfc_llcp_sock_from_sn(local, sn, sn_len, true); } static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len) @@ -1302,7 +1293,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, } llcp_sock = nfc_llcp_sock_from_sn(local, service_name, - service_name_len); + service_name_len, + true); if (!llcp_sock) { sap = 0; goto add_snl; @@ -1322,6 +1314,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, if (sap == LLCP_SAP_MAX) { sap = 0; + nfc_llcp_sock_put(llcp_sock); goto add_snl; } @@ -1339,6 +1332,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, pr_debug("%p %d\n", llcp_sock, sap); + nfc_llcp_sock_put(llcp_sock); add_snl: sdp = nfc_llcp_build_sdres_tlv(tid, sap); if (sdp == NULL) -- 2.34.1

2 1

[PATCH OLK-6.6 v3 00/16] Optimize compaction
by Liu Shixin 01 Apr '24

01 Apr '24

v1->v2: Introduce NR_PAGE_ORDERS and MAX_PAGE_ORDER to avoid conflicts. v2->v3: Fix compile error. Optimize compaction v3. Baolin Wang (2): mm: compaction: update the cc->nr_migratepages when allocating or freeing the freepages mm: compaction: limit the suitable target page order to be less than cc->order Barry Song (1): mm: compaction: avoid fast_isolate_freepages blindly choose improper pageblock Hugh Dickins (1): mm: add page_rmappable_folio() wrapper Hyesoo Yu (1): mm: page_alloc: check the order of compound page even when the order is zero Kemeng Shi (6): mm/compaction: use correct list in move_freelist_{head}/{tail} mm/compaction: call list_is_{first}/{last} more intuitively in move_freelist_{head}/{tail} mm/compaction: correctly return failure with bogus compound_order in strict mode mm/compaction: remove repeat compact_blockskip_flush check in reset_isolation_suitable mm/compaction: improve comment of is_via_compact_memory mm/compaction: factor out code to test if we should run compaction for target order Liu Shixin (1): mm/compaction: introduce NR_PAGE_ORDERS and MAX_PAGE_ORDER Zi Yan (4): mm/page_alloc: remove unused fpi_flags in free_pages_prepare() mm/compaction: enable compacting >0 order folios. mm/compaction: add support for >0 order folio memory compaction. mm/compaction: optimize >0 order folio compaction with free page split. include/trace/events/compaction.h | 6 +- mm/compaction.c | 362 ++++++++++++++++++++---------- mm/internal.h | 16 +- mm/mempolicy.c | 17 +- mm/page_alloc.c | 28 +-- 5 files changed, 274 insertions(+), 155 deletions(-) -- 2.25.1

2 17

[openeuler:openEuler-1.0-LTS 18518/22010] kismet: WARNING: unmet direct dependencies detected for UACCE when selected by CRYPTO_DEV_HISI_QM
by kernel test robot 01 Apr '24

01 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6726609c5990ede3a9fdb318d1dc759d03678a1a commit: c89f49b5f6b23b319f338f7e9e7e9b077ec8f5ff [18518/22010] crypto: hisilicon delete invlaid api and config config: arm64-kismet-CONFIG_UACCE-CONFIG_CRYPTO_DEV_HISI_QM-0-0 (https://download.01.org/0day-ci/archive/20240401/202404011147.PNgq9zF6-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20240401/202404011147.PNgq9zF6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404011147.PNgq9zF6-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for UACCE when selected by CRYPTO_DEV_HISI_QM WARNING: unmet direct dependencies detected for UACCE Depends on [n]: IOMMU_API [=n] Selected by [y]: - CRYPTO_DEV_HISI_QM [=y] && CRYPTO [=y] && CRYPTO_HW [=y] && ARM64 [=y] && PCI [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

openEuler Kernel SIG双周例会
by openEuler conference 01 Apr '24

01 Apr '24

您好！ Kernel 邀请您参加 2024-04-03 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. Xu Yan、Yuan Xia、Liu Yonglong申请成为Kernel contributors 3. 议题征集中（新增议题可回复此邮件，或者直接填写至会议纪要）会议链接：https://meeting.huaweicloud.com:36443/#/j/985365971 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-04-03 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. Xu Yan、Yuan Xia、Liu Yonglong申请成为Kernel contributors 3. 议题征集中（新增议题可回复此邮件，或者直接填写至会议纪要） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/985365971. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

2 1

[PATCH openEuler-1.0-LTS] USB: usbfs: Don't WARN about excessively large memory allocations
by Yu Liao 01 Apr '24

01 Apr '24

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v4.19.193 commit 2ab21d6e1411999b5fb43434f421f00bf50002eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHQL CVE: CVE-2021-47170 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4f2629ea67e7225c3fd292c7fe4f5b3c9d6392de upstream. Syzbot found that the kernel generates a WARNing if the user tries to submit a bulk transfer through usbfs with a buffer that is way too large. This isn't a bug in the kernel; it's merely an invalid request from the user and the usbfs code does handle it correctly. In theory the same thing can happen with async transfers, or with the packet descriptor table for isochronous transfers. To prevent the MM subsystem from complaining about these bad allocation requests, add the __GFP_NOWARN flag to the kmalloc calls for these buffers. CC: Andrew Morton <akpm(a)linux-foundation.org> CC: <stable(a)vger.kernel.org> Reported-and-tested-by: syzbot+882a85c0c8ec4a3e2281(a)syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/20210518201835.GA1140918@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/usb/core/devio.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 35eee2d05ba5..b3b88c08be8a 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -1189,7 +1189,12 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg) ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb)); if (ret) return ret; - tbuf = kmalloc(len1, GFP_KERNEL); + + /* + * len1 can be almost arbitrarily large. Don't WARN if it's + * too big, just fail the request. + */ + tbuf = kmalloc(len1, GFP_KERNEL | __GFP_NOWARN); if (!tbuf) { ret = -ENOMEM; goto done; @@ -1630,7 +1635,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb if (num_sgs) { as->urb->sg = kmalloc_array(num_sgs, sizeof(struct scatterlist), - GFP_KERNEL); + GFP_KERNEL | __GFP_NOWARN); if (!as->urb->sg) { ret = -ENOMEM; goto error; @@ -1665,7 +1670,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb (uurb_start - as->usbm->vm_start); } else { as->urb->transfer_buffer = kmalloc(uurb->buffer_length, - GFP_KERNEL); + GFP_KERNEL | __GFP_NOWARN); if (!as->urb->transfer_buffer) { ret = -ENOMEM; goto error; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-52587
by Yu Liao 01 Apr '24

01 Apr '24

fix CVE-2023-52587 Daniel Vacek (1): IB/ipoib: Fix mcast list locking Jack Wang (1): RDMA/IPoIB: Fix error code return in ipoib_mcast_join drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.25.1

2 3

2024

2023

2022

2021

2020

2019

Kernel April 2024