- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v2] mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task()
by Jinjiang Tu 18 Jan '24

18 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8WVL2 CVE: NA -------------------------------- When memcg oom occurs, commit be8d95530886 ("memcg: support priority for oom") calls memcg_print_bad_task() to print oc->chosen when the chosen task comes from low-priority memcg. oc->chosen may be assigned with -1 in oom_evaluate_task(). Howerver, memcg_print_bad_task() does't check if oc->chosen is -1 and leads to NULL pointer dereference. To fix it, check if oc->chosen is -1 in memcg_print_bad_task(). Fixes: be8d95530886 ("memcg: support priority for oom") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7ab0eec942ba..8327cef9d53a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4219,7 +4219,7 @@ void memcg_print_bad_task(struct oom_control *oc) if (memcg_oom_prio_disabled()) return; - if (oc->chosen) { + if (oc->chosen && oc->chosen != (void *)-1UL) { struct mem_cgroup *memcg; rcu_read_lock(); -- 2.25.1

2 1

[OLK-5.10 0/3] x86/quirks: Add parameter to clear MSIs early on boot
by Zheng Zengkai 18 Jan '24

18 Jan '24

A crash kernel boot failure issue is reported in openeuler 5.10 series kernel(in x86 virtual machine with Hi1822 virtual nic). Finally the issue was narrowed down to irq vector conflict. Backport following patchset from kernel maillist to fix this issue. https://lore.kernel.org/linux-pci/20181018183721.27467-3-gpiccoli@canonical… Guilherme G. Piccoli (3): x86/quirks: Scan all busses for early PCI quirks x86/PCI: Export find_cap() to be used in early PCI code x86/quirks: Add parameter to clear MSIs early on boot .../admin-guide/kernel-parameters.txt | 6 +++ arch/x86/include/asm/pci-direct.h | 2 + arch/x86/kernel/aperture_64.c | 30 +------------ arch/x86/kernel/early-quirks.c | 45 ++++++++++++++++--- arch/x86/pci/common.c | 4 ++ arch/x86/pci/early.c | 25 +++++++++++ 6 files changed, 77 insertions(+), 35 deletions(-) -- 2.20.1

1 3

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2022-48619
by Liao Chen 18 Jan '24

18 Jan '24

fix CVE-2022-48619 Jeff LaBundy (1): Input: add bounds checking to input_set_capability() drivers/input/input.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.8 commit 534733397da26de0303057ce0b93a22bda150365 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 upstream. Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/smb/client/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 386b62d5c133..ea7ccaea711a 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4937,6 +4937,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -4965,14 +4966,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -4996,8 +4998,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc6 commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/smb2ops.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 4f6cc104fdb5..eba4bdfff08a 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -3185,6 +3185,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_sync_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -3213,14 +3214,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_sync_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -3244,8 +3246,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1

[PATCH OLK-5.10] smb: client: fix OOB in receive_encrypted_standard()
by ZhaoLong Wang 18 Jan '24

18 Jan '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc6 commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8WEOK CVE: CVE-2024-0565 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable(a)vger.kernel.org Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/smb2ops.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index b86f559751fd..caee4dedd7dc 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -4886,6 +4886,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, struct smb2_sync_hdr *shdr; unsigned int pdu_length = server->pdu_size; unsigned int buf_size; + unsigned int next_cmd; struct mid_q_entry *mid_entry; int next_is_large; char *next_buffer = NULL; @@ -4914,14 +4915,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_is_large = server->large_buf; one_more: shdr = (struct smb2_sync_hdr *)buf; - if (shdr->NextCommand) { + next_cmd = le32_to_cpu(shdr->NextCommand); + if (next_cmd) { + if (WARN_ON_ONCE(next_cmd > pdu_length)) + return -1; if (next_is_large) next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); - memcpy(next_buffer, - buf + le32_to_cpu(shdr->NextCommand), - pdu_length - le32_to_cpu(shdr->NextCommand)); + memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } mid_entry = smb2_find_mid(server, buf); @@ -4945,8 +4947,8 @@ receive_encrypted_standard(struct TCP_Server_Info *server, else ret = cifs_handle_standard(server, mid_entry); - if (ret == 0 && shdr->NextCommand) { - pdu_length -= le32_to_cpu(shdr->NextCommand); + if (ret == 0 && next_cmd) { + pdu_length -= next_cmd; server->large_buf = next_is_large; if (next_is_large) server->bigbuf = buf = next_buffer; -- 2.34.3

2 1

[PATCH OLK-6.6] mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task()
by Jinjiang Tu 18 Jan '24

18 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8WVL2 CVE: NA -------------------------------- In OLK-5.10, when oc->chosen is assigned with -1 in oom_evaluate_task(), mem_cgroup_scan_tasks() will return -1, and only calls memcg_print_bad_task() when the return value is 0. commit 025b7799b35d ("mm/memcg: remove return value of mem_cgroup_scan_tasks()") removes return value of mem_cgroup_scan_tasks(). When adapting memcg oom priority feature to OLK-6.6, memcg_print_bad_task() will be called in all cases, and forgets to check if oc->chosen is -1, leading to NULL pointer dereference. Fixes: be8d95530886 ("memcg: support priority for oom") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7ab0eec942ba..8327cef9d53a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4219,7 +4219,7 @@ void memcg_print_bad_task(struct oom_control *oc) if (memcg_oom_prio_disabled()) return; - if (oc->chosen) { + if (oc->chosen && oc->chosen != (void *)-1UL) { struct mem_cgroup *memcg; rcu_read_lock(); -- 2.25.1

2 1

[PATCH] mm/oom_kill: fix NULL pointer dereference in memcg_print_bad_task()
by Jinjiang Tu 18 Jan '24

18 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8WVL2 CVE: NA -------------------------------- In OLK-5.10, when oc->chosen is assigned with -1 in oom_evaluate_task(), mem_cgroup_scan_tasks() will return -1, and only calls memcg_print_bad_task() when the return value is 0. commit 025b7799b35d ("mm/memcg: remove return value of mem_cgroup_scan_tasks()") removes return value of mem_cgroup_scan_tasks(). When adapting memcg oom priority feature to OLK-6.6, memcg_print_bad_task() will be called in all cases, and forgets to check if oc->chosen is -1, leading to NULL pointer dereference. Fixes: be8d95530886 ("memcg: support priority for oom") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7ab0eec942ba..8327cef9d53a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4219,7 +4219,7 @@ void memcg_print_bad_task(struct oom_control *oc) if (memcg_oom_prio_disabled()) return; - if (oc->chosen) { + if (oc->chosen && oc->chosen != (void *)-1UL) { struct mem_cgroup *memcg; rcu_read_lock(); -- 2.25.1

1 0

[PATCH OLK-6.6 0/1] misc config
by Chen Ridong 18 Jan '24

18 Jan '24

Chen Ridong (1): cgroup/misc: open_eulerdefconfig open misc config by default arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS 0/2] ext4: synchronize the casefold bugfix from the mainline
by Baokun Li 17 Jan '24

17 Jan '24

Eric Biggers (1): ext4: reject casefold inode flag without casefold feature Theodore Ts'o (1): ext4: improve error handling from ext4_dirhash() fs/ext4/hash.c | 5 ++++- fs/ext4/inode.c | 5 ++++- fs/ext4/namei.c | 40 +++++++++++++++++++++++++++++++--------- 3 files changed, 39 insertions(+), 11 deletions(-) -- 2.31.1

2 3