- Kernel - mailweb.openeuler.org

[PATCH v2 openEuler-1.0-LTS 0/1] openEuler-1.0-LTS: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> mm/madvise: fix potential pte_unmap_unlock pte error. Changelog since v1: - fix style problem. Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH v3 OLK-5.10 0/2] olk-5.10: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport minor bugfix for mm. Changelog since v2: - fix style problem. Changelog since v1: - fix style problem. Mel Gorman (1): mm/page_alloc: always attempt to allocate at least one page during bulk allocation Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 8 ++++---- mm/page_alloc.c | 7 ++++--- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/8] cvm feature patches
by hejingxian 28 Apr '24

28 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches:: kvm: add cvm host feature pmu: enable pmu phys irq inject for cvm kvm: add support for multi-numa and fix kabi change swiotlb: Add restricted DMA alloc/free support swiotlb: add swiotlb io_tlb_list release slots methd mm: enable swiotlb alloc for cvm share mem config: modify arm64 defconfig for cvm feature gicv3: add lpi support for cvm guest arch/arm64/Kconfig | 8 + arch/arm64/configs/defconfig | 3 + arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/include/asm/Kbuild | 1 - arch/arm64/include/asm/cvm_guest.h | 46 ++ arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 ++ arch/arm64/include/asm/set_memory.h | 9 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cvm_guest.c | 93 +++ arch/arm64/kvm/Kconfig | 7 + arch/arm64/kvm/Makefile | 4 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 892 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 12 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/init.c | 3 + arch/arm64/mm/mmu.c | 6 +- arch/arm64/mm/pageattr.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 17 + include/uapi/linux/kvm.h | 27 + kernel/dma/Kconfig | 10 + kernel/dma/direct.c | 56 +- kernel/dma/swiotlb.c | 92 +++ virt/kvm/kvm_main.c | 7 +- 43 files changed, 2843 insertions(+), 57 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/include/asm/set_memory.h create mode 100644 arch/arm64/kernel/cvm_guest.c create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 9

[PATCH openEuler-1.0-LTS 0/1] openEuler-1.0-LTS: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> mm/madvise: fix potential pte_unmap_unlock pte error Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] cifs: fix underflow in parse_server_interfaces()
by Long Li 28 Apr '24

28 Apr '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.8-rc4 commit cffe487026be13eaf37ea28b783d9638ab147204 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJRD CVE: CVE-2024-26828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending. Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/cifs/smb2ops.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/smb2ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index eba4bdfff08a..58d9554e74ce 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -351,7 +351,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, bytes_left = buf_len; p = buf; - while (bytes_left >= sizeof(*p)) { + while (bytes_left >= (ssize_t)sizeof(*p)) { nb_iface++; next = le32_to_cpu(p->Next); if (!next) { @@ -385,7 +385,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, info = *iface_list; bytes_left = buf_len; p = buf; - while (bytes_left >= sizeof(*p)) { + while (bytes_left >= (ssize_t)sizeof(*p)) { info->speed = le64_to_cpu(p->LinkSpeed); info->rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE); info->rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE); -- 2.31.1

2 1

[PATCH v2 OLK-5.10 0/2] olk-5.10: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport minor bugfix for mm. Changelog since v1: - fix style problem. Mel Gorman (1): mm/page_alloc: always attempt to allocate at least one page during bulk allocation Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 8 ++++---- mm/page_alloc.c | 7 ++++--- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/5] CVE-2024-26921
by Ziyang Xuan 28 Apr '24

28 Apr '24

Patchset of CVE-2024-26921. Florian Westphal (1): inet: inet_defrag: prevent sk release while still in use Vasily Averin (2): skbuff: introduce skb_expand_head() skb_expand_head() adjust skb->truesize incorrectly Ziyang Xuan (2): net: Fix KABI break for introducing is_skb_wmem() sk_buff: Fix KABI break for the modification of struct sk_buff include/linux/skbuff.h | 1 + include/net/tcp.h | 2 +- include/net/tcp_ext.h | 14 +++++ net/core/skbuff.c | 52 ++++++++++++++++++ net/ipv4/inet_fragment.c | 70 ++++++++++++++++++++----- net/ipv4/ip_fragment.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- 7 files changed, 127 insertions(+), 16 deletions(-) create mode 100644 include/net/tcp_ext.h -- 2.25.1

2 6

[PATCH OLK-5.10 0/5] Apply patches of ses from stable
by Li Lingfeng 28 Apr '24

28 Apr '24

Jiri Kosina (1): scsi: ses: Handle enclosure with just a primary component gracefully Li Lingfeng (3): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" Revert "scsi: ses: Fix crash caused by kfree an invalid pointer" Revert "scsi: ses: Handle enclosure with just a primary component gracefully" Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses drivers/scsi/ses.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) -- 2.31.1

2 6

[PATCH OLK-5.10 0/2] olk-5.10: bugfix for mm
by Wupeng Ma 28 Apr '24

28 Apr '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport minor bugfix for mm. Mel Gorman (1): mm/page_alloc: always attempt to allocate at least one page during bulk allocation Miaohe Lin (1): mm/madvise: fix potential pte_unmap_unlock pte error mm/madvise.c | 8 ++++---- mm/page_alloc.c | 7 ++++--- 2 files changed, 8 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
by Long Li 28 Apr '24

28 Apr '24

From: Jorge Mora <jmora1300(a)gmail.com> stable inclusion from stable-v5.10.167 commit 4403438eaca6e91f02d272211c4d6b045092396b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK78 CVE: CVE-2024-26870 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 251a658bbfceafb4d58c76b77682c8bf7bcfad65 ] A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs4_listxattr() does not return an error because either generic_listxattr() or nfs4_listxattr_nfs4_label() consumes exactly all the bytes then size is 0 when calling nfs4_listxattr_nfs4_user() which then triggers the following kernel BUG: [ 99.403778] kernel BUG at mm/usercopy.c:102! [ 99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1 [ 99.415827] Call trace: [ 99.415985] usercopy_abort+0x70/0xa0 [ 99.416227] __check_heap_object+0x134/0x158 [ 99.416505] check_heap_object+0x150/0x188 [ 99.416696] __check_object_size.part.0+0x78/0x168 [ 99.416886] __check_object_size+0x28/0x40 [ 99.417078] listxattr+0x8c/0x120 [ 99.417252] path_listxattr+0x78/0xe0 [ 99.417476] __arm64_sys_listxattr+0x28/0x40 [ 99.417723] invoke_syscall+0x78/0x100 [ 99.417929] el0_svc_common.constprop.0+0x48/0xf0 [ 99.418186] do_el0_svc+0x24/0x38 [ 99.418376] el0_svc+0x3c/0x110 [ 99.418554] el0t_64_sync_handler+0x120/0x130 [ 99.418788] el0t_64_sync+0x194/0x198 [ 99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000) Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl', thus calling lisxattr() with size = 16 will trigger the bug. Add check on nfs4_listxattr() to return ERANGE error when it is called with size > 0 and the return value is greater than size. Fixes: 012a211abd5d ("NFSv4.2: hook in the user extended attribute handlers") Signed-off-by: Jorge Mora <mora(a)netapp.com> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nfs/nfs4proc.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index f3f41027f697..62c227eb75bd 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -10367,29 +10367,33 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = { static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) { ssize_t error, error2, error3; + size_t left = size; - error = generic_listxattr(dentry, list, size); + error = generic_listxattr(dentry, list, left); if (error < 0) return error; if (list) { list += error; - size -= error; + left -= error; } - error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, size); + error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, left); if (error2 < 0) return error2; if (list) { list += error2; - size -= error2; + left -= error2; } - error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, size); + error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left); if (error3 < 0) return error3; - return error + error2 + error3; + error += error2 + error3; + if (size && error > size) + return -ERANGE; + return error; } static void nfs4_enable_swap(struct inode *inode) -- 2.31.1

2 1