- Kernel - mailweb.openeuler.org

[PATCH OPENEULER-1.0-LTS] [Backport] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] [Backport] drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()
by Lin Ruifeng 28 Apr '25

28 Apr '25

From: Zhou Qingyang <zhou1615(a)umn.edu> stable inclusion from stable-v4.19.238 commit 2c729dec8c1e3e2892fde5ce8181553860914e74 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6X6 CVE: CVE-2022-49232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 588a70177df3b1777484267584ef38ab2ca899a2 ] In amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode() is assigned to mode and is passed to drm_mode_probed_add() directly after that. drm_mode_probed_add() passes &mode->head to list_add_tail(), and there is a dereference of it in list_add_tail() without recoveries, which could lead to NULL pointer dereference on failure of amdgpu_dm_create_common_mode(). Fix this by adding a NULL check of mode. This bug was found by a static analyzer. Builds with 'make allyesconfig' show no new warnings, and our static analyzer no longer warns about this code. Fixes: e7b07ceef2a6 ("drm/amd/display: Merge amdgpu_dm_types and amdgpu_dm") Signed-off-by: Zhou Qingyang <zhou1615(a)umn.edu> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 65fb64c8727f..58b66ca4f3bd 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -3595,6 +3595,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, mode = amdgpu_dm_create_common_mode(encoder, common_modes[i].name, common_modes[i].w, common_modes[i].h); + if (!mode) + continue; + drm_mode_probed_add(connector, mode); amdgpu_dm_connector->num_modes++; } -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] [Backport] staging: rtl8712: fix uninit-value in r871xu_drv_init()
by Lin Ruifeng 28 Apr '25

28 Apr '25

From: Wang Cheng <wanngchenng(a)gmail.com> stable inclusion from stable-v4.19.247 commit a6535d00a9d54ce1c2a8d86a85001ffb6844f9b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5XN CVE: CVE-2022-49298 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ] When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0, 'mac[6]' will not be initialized. BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5358 [inline] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline] port_event drivers/usb/core/hub.c:5660 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454 kthread+0x3c7/0x500 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 Local variable mac created at: r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 KMSAN: uninit-value in r871xu_drv_init https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00b… Reported-by: <syzbot+6f5ecd144854c0d8580b(a)syzkaller.appspotmail.com> Tested-by: <syzbot+6f5ecd144854c0d8580b(a)syzkaller.appspotmail.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Wang Cheng <wanngchenng(a)gmail.com> Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.16526182… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/staging/rtl8712/usb_intf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c index 709d687180bf..c10d1cbad816 100644 --- a/drivers/staging/rtl8712/usb_intf.c +++ b/drivers/staging/rtl8712/usb_intf.c @@ -569,13 +569,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf, } else { AutoloadFail = false; } - if (((mac[0] == 0xff) && (mac[1] == 0xff) && + if ((!AutoloadFail) || + ((mac[0] == 0xff) && (mac[1] == 0xff) && (mac[2] == 0xff) && (mac[3] == 0xff) && (mac[4] == 0xff) && (mac[5] == 0xff)) || ((mac[0] == 0x00) && (mac[1] == 0x00) && (mac[2] == 0x00) && (mac[3] == 0x00) && - (mac[4] == 0x00) && (mac[5] == 0x00)) || - (!AutoloadFail)) { + (mac[4] == 0x00) && (mac[5] == 0x00))) { mac[0] = 0x00; mac[1] = 0xe0; mac[2] = 0x4c; -- 2.22.0

1 0

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] [Backport] jfs: add check read-only before truncation in jfs_truncate_nolock()
by zhangyuwei20＠huawei.com 28 Apr '25

28 Apr '25

From: Zhang Yuwei <zhangyuwei20(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit b5799dd77054c1ec49b0088b006c9908e256843b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOQ CVE: CVE-2024-58094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only filesystem. Call stack: block_write_begin() { jfs_write_failed() { jfs_truncate() { jfs_truncate_nolock() { txEnd() { ... log = JFS_SBI(tblk->sb)->log; // (log == NULL) If the `isReadOnly(ip)` condition is triggered in `jfs_truncate_nolock`, the function execution will stop, and no further data modification will occur. Instead, the `xtTruncate` function will be called with the "COMMIT_WMAP" flag, preventing modifications in "read-only" mode. Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+4e89b5368baba8324e07(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4e89b5368baba8324e07 Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> --- fs/jfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 68779cc3609a..5a60ba8c021e 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -381,7 +381,7 @@ void jfs_truncate_nolock(struct inode *ip, loff_t length) ASSERT(length >= 0); - if (test_cflag(COMMIT_Nolink, ip)) { + if (test_cflag(COMMIT_Nolink, ip) || isReadOnly(ip)) { xtTruncate(0, ip, length, COMMIT_WMAP); return; } -- 2.22.0

1 0

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Verify event formats that have "%*p.."
by Pu Lehui 27 Apr '25

27 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.15-rc1 commit ea8d7647f9ddf1f81e2027ed305299797299aa03 category: bugfix bugzilla: 190584 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of "%*pbl". Link: https://lore.kernel.org/all/bcba4d76-2c3f-4d11-baf0-02905db953dd@oracle.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts for dereferencing pointers") Link: https://lore.kernel.org/20250327195311.2d89ec66@gandalf.local.home Reported-by: Libo Chen <libo.chen(a)oracle.com> Reviewed-by: Libo Chen <libo.chen(a)oracle.com> Tested-by: Libo Chen <libo.chen(a)oracle.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events.c samples/trace_events/trace-events-sample.h [The conflicts were due to some minor issues] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events.c | 7 +++++++ samples/trace_events/trace-events-sample.h | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9d22745cdea5..f2e07d470784 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -470,6 +470,7 @@ static void test_event_printk(struct trace_event_call *call) case '%': continue; case 'p': + do_pointer: /* Find dereferencing fields */ switch (fmt[i + 1]) { case 'B': case 'R': case 'r': @@ -498,6 +499,12 @@ static void test_event_printk(struct trace_event_call *call) continue; if (fmt[i + j] == '*') { star = true; + /* Handle %*pbl case */ + if (!j && fmt[i + 1] == 'p') { + arg++; + i++; + goto do_pointer; + } continue; } if ((fmt[i + j] == 's')) { diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h index 1c6b843b8c4e..6a5d4717f37a 100644 --- a/samples/trace_events/trace-events-sample.h +++ b/samples/trace_events/trace-events-sample.h @@ -315,7 +315,8 @@ TRACE_EVENT(foo_bar, __assign_cpumask(cpum, cpumask_bits(mask)); ), - TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, + TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s [%d] %*pbl", + __entry->foo, __entry->bar, /* * Notice here the use of some helper functions. This includes: @@ -360,7 +361,10 @@ TRACE_EVENT(foo_bar, __get_dynamic_array_len(list) / sizeof(int), sizeof(int)), __get_str(str), __get_bitmask(cpus), __get_cpumask(cpum), - __get_str(vstr)) + __get_str(vstr), + __get_dynamic_array_len(cpus), + __get_dynamic_array_len(cpus), + __get_dynamic_array(cpus)) ); /* -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 27 Apr '25

27 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190582 -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-6.6] ext4: fix the logic to determine whether buffered IO can use iomap
by Yongjian Sun 27 Apr '25

27 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC2EYK ---------------------------------------- The current logic for determining whether buffered IO can use iomap only checks for the EXT4_MOUNT_JOURNAL_DATA mount flag. However, when a user dynamically sets the EXT4_INODE_JOURNAL_DATA flag for a specific file, that file should switch to `data=journal` mode and clear the EXT4_STATE_BUFFERED_IOMAP flag, falling back to the regular buffer head path. Therefore, we have added a new condition to the logic to check if the file has the EXT4_INODE_JOURNAL_DATA flag set. It is important to note that if this flag is set dynamically for a specific file during runtime, the setting cannot take effect immediately because the inode already exists in memory with the EXT4_STATE_BUFFERED_IOMAP flag set. To make it take effect immediately, the user needs to execute a drop cache operation. Fixes: c691783a086b ("ext4: partial enable iomap for regular file's buffered IO path") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index bc5aa01cc6da..1e27155797cc 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5359,7 +5359,8 @@ bool ext4_should_use_buffered_iomap(struct inode *inode) return false; if (ext4_has_feature_verity(sb)) return false; - if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA || + ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA)) return false; if (!S_ISREG(inode->i_mode)) return false; -- 2.39.2

2 1

[PATCH OLK-5.10] proc: fix UAF in proc_get_inode()
by Yongjian Sun 27 Apr '25

27 Apr '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.12-rc3 commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFS CVE: CVE-2025-21999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference. rmmod lookup sys_delete_module proc_lookup_de pde_get(de); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e [adobriyan(a)gmail.com: don't do 2 atomic ops on the common path] Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: David S. Miller <davem(a)davemloft.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akipm(a)linux-foundation.org> Conflicts: fs/proc/internal.h [ef1d61781bc67 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/proc/generic.c | 10 +++++++++- fs/proc/inode.c | 6 +++--- fs/proc/internal.h | 14 ++++++++++++++ include/linux/proc_fs.h | 7 +++++-- 4 files changed, 31 insertions(+), 6 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 5898761698c2..7b6d9c77b425 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -563,10 +563,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, return p; } -static inline void pde_set_flags(struct proc_dir_entry *pde) +static void pde_set_flags(struct proc_dir_entry *pde) { if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) pde->flags |= PROC_ENTRY_PERMANENT; + if (pde->proc_ops->proc_read_iter) + pde->flags |= PROC_ENTRY_proc_read_iter; +#ifdef CONFIG_COMPAT + if (pde->proc_ops->proc_compat_ioctl) + pde->flags |= PROC_ENTRY_proc_compat_ioctl; +#endif } struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, @@ -630,6 +636,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, p->proc_ops = &proc_seq_ops; p->seq_ops = ops; p->state_size = state_size; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_seq_private); @@ -660,6 +667,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, return NULL; p->proc_ops = &proc_single_ops; p->single_show = show; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_single_data); diff --git a/fs/proc/inode.c b/fs/proc/inode.c index bde6b6f69852..ba35ffc426ea 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -684,13 +684,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (S_ISREG(inode->i_mode)) { inode->i_op = de->proc_iops; - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops; else inode->i_fop = &proc_reg_file_ops; #ifdef CONFIG_COMPAT - if (de->proc_ops->proc_compat_ioctl) { - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_compat_ioctl(de)) { + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops_compat; else inode->i_fop = &proc_reg_file_ops_compat; diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 104945bbeb9f..c75d0db70a85 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -79,6 +79,20 @@ static inline bool pde_is_permanent(const struct proc_dir_entry *pde) return pde->flags & PROC_ENTRY_PERMANENT; } +static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde) +{ + return pde->flags & PROC_ENTRY_proc_read_iter; +} + +static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) +{ +#ifdef CONFIG_COMPAT + return pde->flags & PROC_ENTRY_proc_compat_ioctl; +#else + return false; +#endif +} + extern struct kmem_cache *proc_dir_entry_cache; void pde_free(struct proc_dir_entry *pde); diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 8c892730a1f1..9f8e0072b30f 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -20,10 +20,13 @@ enum { * If in doubt, ignore this flag. */ #ifdef MODULE - PROC_ENTRY_PERMANENT = 0U, + PROC_ENTRY_PERMANENT = 0U, #else - PROC_ENTRY_PERMANENT = 1U << 0, + PROC_ENTRY_PERMANENT = 1U << 0, #endif + + PROC_ENTRY_proc_read_iter = 1U << 1, + PROC_ENTRY_proc_compat_ioctl = 1U << 2, }; struct proc_ops { -- 2.39.2

2 1