August 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: unregister flowtable hooks on netns exit
by Zhengchao Shao 26 Aug '24

26 Aug '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.198 commit e51f30826bc5384801df98d76109c94953d1df64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALQ1E CVE: CVE-2022-48935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…> -------------------------------- commit 6069da443bf65f513bb507bb21e2f87cfb1ad0b6 upstream. Unregister flowtable hooks before they are releases via nf_tables_flowtable_destroy() otherwise hook core reports UAF. BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666 CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106 print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450 kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450 nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429 nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571 nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232 nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652 nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652 __nft_release_hook() calls nft_unregister_flowtable_net_hooks() which only unregisters the hooks, then after RCU grace period, it is guaranteed that no packets add new entries to the flowtable (no flow offload rules and flowtable hooks are reachable from packet path), so it is safe to call nf_flow_table_free() which cleans up the remaining entries from the flowtable (both software and hardware) and it unbinds the flow_block. Fixes: ff4bf2f42a40 ("netfilter: nf_tables: add nft_unregister_flowtable_hook()") Reported-by: syzbot+e918523f77e62790d6d9(a)syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_tables_api.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index f3492376bf74..9890a8814b52 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -9135,16 +9135,24 @@ int __nft_release_basechain(struct nft_ctx *ctx) } EXPORT_SYMBOL_GPL(__nft_release_basechain); +static void __nft_release_hook(struct net *net, struct nft_table *table) +{ + struct nft_flowtable *flowtable; + struct nft_chain *chain; + + list_for_each_entry(chain, &table->chains, list) + nf_tables_unregister_hook(net, table, chain); + list_for_each_entry(flowtable, &table->flowtables, list) + nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list); +} + static void __nft_release_hooks(struct net *net) { struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); struct nft_table *table; - struct nft_chain *chain; - list_for_each_entry(table, &nft_net->tables, list) { - list_for_each_entry(chain, &table->chains, list) - nf_tables_unregister_hook(net, table, chain); - } + list_for_each_entry(table, &nft_net->tables, list) + __nft_release_hook(net, table); } static void __nft_release_table(struct net *net, struct nft_table *table) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 212ca308cc9fa1267c1d7934ac416660f41c549f
by kernel test robot 25 Aug '24

25 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 212ca308cc9fa1267c1d7934ac416660f41c549f !11113 mISDN: Fix a use after free in hfcmulti_tx() Warning reports: https://lore.kernel.org/oe-kbuild-all/202408241654.npDnHEKI-lkp@intel.com Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-003-20240825 | |-- drivers-net-ethernet-cisco-enic-vnic_dev.c:warning:a0-may-be-used-uninitialized | `-- drivers-net-ethernet-cisco-enic-vnic_dev.c:warning:a1-may-be-used-uninitialized `-- x86_64-buildonly-randconfig-001-20240821 `-- drivers-crypto-.tmp_zhaoxin-sha.o:warning:objtool:missing-symbol-for-section-.exit.text elapsed time: 800m configs tested: 10 configs skipped: 111 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240825 gcc-14.1.0 arm64 randconfig-002-20240825 gcc-14.1.0 arm64 randconfig-003-20240825 gcc-14.1.0 arm64 randconfig-004-20240825 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-11 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 3e84c5c153639341b5160c19defa29121fd98e0e
by kernel test robot 25 Aug '24

25 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 3e84c5c153639341b5160c19defa29121fd98e0e !11091 net/mlx5: Always drain health in shutdown callback elapsed time: 872m configs tested: 34 configs skipped: 111 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240825 clang-20 arm64 randconfig-002-20240825 gcc-14.1.0 arm64 randconfig-003-20240825 clang-20 arm64 randconfig-004-20240825 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240824 clang-18 x86_64 buildonly-randconfig-002-20240824 clang-18 x86_64 buildonly-randconfig-003-20240824 clang-18 x86_64 buildonly-randconfig-004-20240824 clang-18 x86_64 buildonly-randconfig-005-20240824 gcc-12 x86_64 buildonly-randconfig-006-20240824 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240824 gcc-12 x86_64 randconfig-002-20240824 clang-18 x86_64 randconfig-003-20240824 gcc-12 x86_64 randconfig-004-20240824 clang-18 x86_64 randconfig-005-20240824 gcc-12 x86_64 randconfig-006-20240824 gcc-12 x86_64 randconfig-011-20240824 clang-18 x86_64 randconfig-012-20240824 clang-18 x86_64 randconfig-013-20240824 clang-18 x86_64 randconfig-014-20240824 clang-18 x86_64 randconfig-015-20240824 clang-18 x86_64 randconfig-016-20240824 clang-18 x86_64 randconfig-071-20240824 gcc-12 x86_64 randconfig-072-20240824 gcc-12 x86_64 randconfig-073-20240824 gcc-12 x86_64 randconfig-074-20240824 clang-18 x86_64 randconfig-075-20240824 clang-18 x86_64 randconfig-076-20240824 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] protect the fetch of ->fd[fd] in do_dup2() from mispredictions
by Long Li 24 Aug '24

24 Aug '24

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v4.19.319 commit ed42e8ff509d2a61c6642d1825032072dab79f26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPUO CVE: CVE-2024-42265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream. both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path. Cc: stable(a)vger.kernel.org Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/file.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/file.c b/fs/file.c index b5df6680301c..4c192bc68494 100644 --- a/fs/file.c +++ b/fs/file.c @@ -978,6 +978,7 @@ __releases(&files->file_lock) * tables and this condition does not arise without those. */ fdt = files_fdtable(files); + fd = array_index_nospec(fd, fdt->max_fds); tofree = fdt->fd[fd]; if (!tofree && fd_is_open(fd, fdt)) { err = -EBUSY; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] protect the fetch of ->fd[fd] in do_dup2() from mispredictions
by Long Li 24 Aug '24

24 Aug '24

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v5.10.223 commit 08775b3d6ed117cf4518754ec7300ee42b6a5368 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPUO CVE: CVE-2024-42265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream. both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path. Cc: stable(a)vger.kernel.org Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/file.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/file.c b/fs/file.c index f1b6faa87e3d..4ad1eaac9f5d 100644 --- a/fs/file.c +++ b/fs/file.c @@ -1128,6 +1128,7 @@ __releases(&files->file_lock) * tables and this condition does not arise without those. */ fdt = files_fdtable(files); + fd = array_index_nospec(fd, fdt->max_fds); tofree = fdt->fd[fd]; if (!tofree && fd_is_open(fd, fdt)) { err = -EBUSY; -- 2.39.2

2 1

[PATCH OLK-5.10] protect the fetch of ->fd[fd] in do_dup2() from mispredictions
by Long Li 24 Aug '24

24 Aug '24

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v5.10.223 commit 08775b3d6ed117cf4518754ec7300ee42b6a5368 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPUO CVE: CVE-2024-42265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream. both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path. Cc: stable(a)vger.kernel.org Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/file.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/file.c b/fs/file.c index af3968e29ecf..8d5052d5e7e6 100644 --- a/fs/file.c +++ b/fs/file.c @@ -1143,6 +1143,7 @@ __releases(&files->file_lock) * tables and this condition does not arise without those. */ fdt = files_fdtable(files); + fd = array_index_nospec(fd, fdt->max_fds); tofree = fdt->fd[fd]; if (!tofree && fd_is_open(fd, fdt)) { err = -EBUSY; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] KVM: x86/mmu: make apf token non-zero to fix bug
by Ye Bin 24 Aug '24

24 Aug '24

From: Liang Zhang <zhangliang5(a)huawei.com> stable inclusion from stable-v5.10.103 commit 72fdfc75d4217b32363cc80def3de2cb3fef3f02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALPYZ CVE: CVE-2022-48943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6f3c1fc53d86d580d8d6d749c4af23705e4f6f79 upstream. In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000 Signed-off-by: Liang Zhang <zhangliang5(a)huawei.com> Message-Id: <20220222031239.1076682-1-zhangliang5(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts arch/x86/kvm/mmu.c arch/x86/kvm/mmu/mmu.c [As mmu.c not move to mmu/mmu.c] Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/x86/kvm/mmu.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index f0b393dc74f7..873e3b6948ff 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -4088,11 +4088,22 @@ static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gva_t gva, error_code, gfn, prefault); } +static u32 alloc_apf_token(struct kvm_vcpu *vcpu) +{ + /* make sure the token value is not 0 */ + u32 id = vcpu->arch.apf.id; + + if (id << 12 == 0) + vcpu->arch.apf.id = 1; + + return (vcpu->arch.apf.id++ << 12) | vcpu->vcpu_id; +} + static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn) { struct kvm_arch_async_pf arch; - arch.token = (vcpu->arch.apf.id++ << 12) | vcpu->vcpu_id; + arch.token = alloc_apf_token(vcpu); arch.gfn = gfn; arch.direct_map = vcpu->arch.mmu.direct_map; arch.cr3 = vcpu->arch.mmu.get_cr3(vcpu); -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] fix cve-2024-42312
by Long Li 24 Aug '24

24 Aug '24

This patch set cve-2024-42312 Thomas Weißschuh (2): sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table) sysctl: always initialize i_uid/i_gid fs/proc/proc_sysctl.c | 8 +++----- include/linux/sysctl.h | 1 - ipc/ipc_sysctl.c | 3 +-- ipc/mq_sysctl.c | 3 +-- net/sysctl_net.c | 1 - 5 files changed, 5 insertions(+), 11 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] iio: adc: men_z188_adc: Fix a resource leak in an error handling path
by Ye Bin 24 Aug '24

24 Aug '24

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v4.19.232 commit 53d43a9c8dd224e66559fe86af1e473802c7130e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALQ1H CVE: CVE-2022-48928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e0a2e37f303828d030a83f33ffe14b36cb88d563 upstream. If iio_device_register() fails, a previous ioremap() is left unbalanced. Update the error handling path and add the missing iounmap() call, as already done in the remove function. Fixes: 74aeac4da66f ("iio: adc: Add MEN 16z188 ADC driver") Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Link: https://lore.kernel.org/r/320fc777863880247c2aff4a9d1a54ba69abf080.16434451… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/iio/adc/men_z188_adc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c index c80261748d8f..49827bb64897 100644 --- a/drivers/iio/adc/men_z188_adc.c +++ b/drivers/iio/adc/men_z188_adc.c @@ -106,6 +106,7 @@ static int men_z188_probe(struct mcb_device *dev, struct z188_adc *adc; struct iio_dev *indio_dev; struct resource *mem; + int ret; indio_dev = devm_iio_device_alloc(&dev->dev, sizeof(struct z188_adc)); if (!indio_dev) @@ -132,8 +133,14 @@ static int men_z188_probe(struct mcb_device *dev, adc->mem = mem; mcb_set_drvdata(dev, indio_dev); - return iio_device_register(indio_dev); + ret = iio_device_register(indio_dev); + if (ret) + goto err_unmap; + + return 0; +err_unmap: + iounmap(adc->base); err: mcb_release_mem(mem); return -ENXIO; -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 20578/23548] drivers/crypto/.tmp_zhaoxin-sha.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 24 Aug '24

24 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 212ca308cc9fa1267c1d7934ac416660f41c549f commit: 0f74c26725b8cd5e9b968081850c0303a9fc9137 [20578/23548] crypto: Add Zhaoxin ACE driver config: x86_64-buildonly-randconfig-001-20240821 (https://download.01.org/0day-ci/archive/20240824/202408241654.npDnHEKI-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240824/202408241654.npDnHEKI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408241654.npDnHEKI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/.tmp_zhaoxin-sha.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0