- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1336/1336] drivers/staging/gmjstcm/tcm_tis_spi.c:817:36: warning: 'tcm_tis_spi_acpi_match' defined but not used
by kernel test robot 19 Dec '24

19 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: dda59452adcd5503512e4d25631db28a50f38fd0 commit: 5ebbfc8c29eb5eb6dfdab853bdb2a622e0533d7e [1336/1336] staging: TCM: add GMJS(Nationz Tech) TCM driver. config: arm64-randconfig-003-20241219 (https://download.01.org/0day-ci/archive/20241219/202412192143.ddGXn3L0-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241219/202412192143.ddGXn3L0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412192143.ddGXn3L0-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/staging/gmjstcm/tcm_tis_spi.c:109:5: warning: no previous prototype for 'tcm_tis_spi_transfer' [-Wmissing-prototypes] 109 | int tcm_tis_spi_transfer(struct device *dev, u32 addr, u16 len, | ^~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'recv_data': drivers/staging/gmjstcm/tcm_tis_spi.c:423:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 423 | int ret; | ^~~ drivers/staging/gmjstcm/tcm_tis_spi.c: At top level: >> drivers/staging/gmjstcm/tcm_tis_spi.c:817:36: warning: 'tcm_tis_spi_acpi_match' defined but not used [-Wunused-const-variable=] 817 | static const struct acpi_device_id tcm_tis_spi_acpi_match[] = { | ^~~~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'cleanup_tis': drivers/staging/gmjstcm/tcm_tis_spi.c:249:17: warning: 'inten' may be used uninitialized [-Wmaybe-uninitialized] 249 | tcm_tis_writel(chip->dev, TCM_INT_ENABLE(chip->vendor.locality), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 250 | ~TCM_GLOBAL_INT_ENABLE & inten); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c:237:13: note: 'inten' was declared here 237 | u32 inten; | ^~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'tcm_tis_init': drivers/staging/gmjstcm/tcm_tis_spi.c:264:21: warning: 'vendor' may be used uninitialized [-Wmaybe-uninitialized] 264 | if ((vendor & 0xffff) != 0x19f5 && (vendor & 0xffff) != 0x1B4E) | ~~~~~~~~^~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c:260:13: note: 'vendor' was declared here 260 | u32 vendor, intfcaps; | ^~~~~~ -- aarch64-linux-ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions aarch64-linux-ld: fs/ext4/super.o: in function `ext4_handle_error': super.c:(.text+0x1472c): undefined reference to `__alloc_skb' >> super.c:(.text+0x1472c): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__alloc_skb' >> aarch64-linux-ld: super.c:(.text+0x14794): undefined reference to `__nlmsg_put' >> super.c:(.text+0x14794): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__nlmsg_put' >> aarch64-linux-ld: super.c:(.text+0x14878): undefined reference to `netlink_broadcast' >> super.c:(.text+0x14878): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `netlink_broadcast' >> aarch64-linux-ld: super.c:(.text+0x149cc): undefined reference to `kfree_skb' >> super.c:(.text+0x149cc): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `kfree_skb' aarch64-linux-ld: fs/ext4/super.o: in function `ext4_init_fs': super.c:(.init.text+0x52e4): undefined reference to `init_net' >> super.c:(.init.text+0x52e4): relocation truncated to fit: R_AARCH64_ADR_PREL_PG_HI21 against undefined symbol `init_net' >> aarch64-linux-ld: super.c:(.init.text+0x52ec): undefined reference to `init_net' >> aarch64-linux-ld: super.c:(.init.text+0x52f4): undefined reference to `__netlink_kernel_create' >> super.c:(.init.text+0x52f4): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__netlink_kernel_create' aarch64-linux-ld: fs/ext4/super.o: in function `ext4_exit_fs': super.c:(.exit.text+0x7c): undefined reference to `netlink_kernel_release' >> super.c:(.exit.text+0x7c): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `netlink_kernel_release' vim +/tcm_tis_spi_acpi_match +817 drivers/staging/gmjstcm/tcm_tis_spi.c 816 > 817 static const struct acpi_device_id tcm_tis_spi_acpi_match[] = { 818 {"TCMS0001", 0}, 819 {"SMO0768", 0}, 820 {"ZIC0601", 0}, 821 {} 822 }; 823 MODULE_DEVICE_TABLE(acpi, tcm_tis_spi_acpi_match); 824 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2024-50194
by Ze Zuo 19 Dec '24

19 Dec '24

Fix CVE-2024-50194 Mark Rutland (1): arm64: probes: Fix uprobes for big-endian kernels junhua huang (2): arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning arch/arm64/include/asm/uprobes.h | 12 +++++------- arch/arm64/kernel/probes/uprobes.c | 4 ++-- 2 files changed, 7 insertions(+), 9 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 00/16] net:yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 19 Dec '24

19 Dec '24

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (16): motorcomm:yt6801: Add support for a pci table in this module motorcomm:yt6801: Implement pci_driver shutdown motorcomm:yt6801: Implement the fxgmac_drv_probe function motorcomm:yt6801: Implement the .ndo_open function motorcomm:yt6801: Implement the fxgmac_start function motorcomm:yt6801: Implement the poll functions motorcomm:yt6801: Implement the fxgmac_init function motorcomm:yt6801: Implement the fxgmac_read_mac_addr function motorcomm:yt6801: Implement some hw_ops function motorcomm:yt6801: Implement .ndo_start_xmit function motorcomm:yt6801: Implement some net_device_ops function motorcomm:yt6801: Implement .ndo_tx_timeout and .ndo_change_mtu functions motorcomm:yt6801: Implement some ethtool_ops function motorcomm:yt6801: Implement the WOL function of ethtool_ops motorcomm:yt6801: Implement pci_driver suspend and resume motorcomm:yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 9 + .../net/ethernet/motorcomm/yt6801/yt6801.h | 617 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.c | 638 ++++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 39 + .../motorcomm/yt6801/yt6801_ethtool.c | 838 ++++ .../net/ethernet/motorcomm/yt6801/yt6801_hw.c | 3383 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.c | 2908 ++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.h | 32 + .../ethernet/motorcomm/yt6801/yt6801_pci.c | 191 + .../ethernet/motorcomm/yt6801/yt6801_type.h | 1398 +++++++ 15 files changed, 10096 insertions(+) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_ethtool.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_hw.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_pci.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

1 16

[PATCH OLK-5.10] soc: hisilicon: hbmdev: Only support built-in
by Zhang Zekun 19 Dec '24

19 Dec '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB78B0 ----------------------------------------------------------- Only support built in compile for hisi_hbmdev. We need to use lock_device_hotplug_sysfs() to prevent directly racing on acpi_scan_lock(), hbm memory can be time consumed during power on. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- drivers/soc/hisilicon/Kconfig | 2 +- drivers/soc/hisilicon/hisi_hbmdev.c | 19 ++++++++++++++++--- 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 4c117f2f55f1..dba4e3b2e79a 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6117,7 +6117,7 @@ CONFIG_QCOM_KRYO_L2_ACCESSORS=y # Hisilicon SoC drivers # CONFIG_KUNPENG_HCCS=m -CONFIG_HISI_HBMDEV=m +CONFIG_HISI_HBMDEV=y CONFIG_HISI_HBMCACHE=m CONFIG_HISI_HBMDEV_ACLS=y CONFIG_HISI_L3T=m diff --git a/drivers/soc/hisilicon/Kconfig b/drivers/soc/hisilicon/Kconfig index 0e79de44a01f..2dc1a2060d30 100644 --- a/drivers/soc/hisilicon/Kconfig +++ b/drivers/soc/hisilicon/Kconfig @@ -19,7 +19,7 @@ config KUNPENG_HCCS health status and port information of HCCS on Kunpeng SoC. config HISI_HBMDEV - tristate "add extra support for hbm memory device" + bool "add extra support for hbm memory device" depends on ACPI_HOTPLUG_MEMORY select ACPI_CONTAINER help diff --git a/drivers/soc/hisilicon/hisi_hbmdev.c b/drivers/soc/hisilicon/hisi_hbmdev.c index f09388a80009..7ed874ff2206 100644 --- a/drivers/soc/hisilicon/hisi_hbmdev.c +++ b/drivers/soc/hisilicon/hisi_hbmdev.c @@ -59,9 +59,8 @@ static int memdev_power_on(struct acpi_device *adev) acpi_handle handle = adev->handle; acpi_status status; - acpi_scan_lock_acquire(); + /* Power on and online the devices */ status = acpi_evaluate_object(handle, "_ON", NULL, NULL); - acpi_scan_lock_release(); if (ACPI_FAILURE(status)) { acpi_handle_warn(handle, "Power on failed (0x%x)\n", status); return -ENODEV; @@ -100,6 +99,7 @@ static int memdev_power_off(struct acpi_device *adev) acpi_dev_for_each_child(adev, hbmdev_check, NULL); acpi_scan_lock_release(); + /* Eject the devices and power off */ status = acpi_evaluate_object(handle, "_OFF", NULL, NULL); if (ACPI_FAILURE(status)) { return -ENODEV; @@ -112,7 +112,12 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, { struct acpi_device *adev = ACPI_COMPANION(dev); const int type = online_type_from_str(buf); - int ret = -EINVAL; + int ret; + + /* Disallow pending on the mutex to avoid potential hung task*/ + ret = lock_device_hotplug_sysfs(); + if (ret) + return ret; switch (type) { case STATE_ONLINE: @@ -124,6 +129,7 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, default: break; } + unlock_device_hotplug(); if (ret) return ret; @@ -196,9 +202,16 @@ static int container_init(void) return 0; } +static struct acpi_platform_list hbm_plat_info[] = { + {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, all_versions, NULL, 0}, + { } +}; static int __init hbmdev_init(void) { + if (acpi_match_platform_list(hbm_plat_info) < 0) + return 0; + return container_init(); } module_init(hbmdev_init); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] selinux: improve error checking in sel_write_load()
by Gu Bowen 19 Dec '24

19 Dec '24

From: Paul Moore <paul(a)paul-moore.com> stable inclusion from stable-v4.19.323 commit acc599ee46881a9d377c33e7848e6bb2d97ef862 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBCC6Z CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 42c773238037c90b3302bf37a57ae3b5c3f6004a ] Move our existing input sanity checking to the top of sel_write_load() and add a check to ensure the buffer size is non-zero. Move a local variable initialization from the declaration to before it is used. Minor style adjustments. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> [cascardo: keep fsi initialization at its declaration point as it is used earlier] [cascardo: keep check for 64MiB size limit] Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/selinux/selinuxfs.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index c1f8b18fa27b..d342c08cdd2b 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -536,6 +536,16 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, ssize_t length; void *data = NULL; + /* no partial writes */ + if (*ppos) + return -EINVAL; + /* no empty policies */ + if (!count) + return -EINVAL; + + if (count > 64 * 1024 * 1024) + return -EFBIG; + mutex_lock(&fsi->mutex); length = avc_has_perm(&selinux_state, @@ -544,23 +554,15 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, if (length) goto out; - /* No partial writes. */ - length = -EINVAL; - if (*ppos != 0) - goto out; - - length = -EFBIG; - if (count > 64 * 1024 * 1024) - goto out; - - length = -ENOMEM; data = vmalloc(count); - if (!data) + if (!data) { + length = -ENOMEM; goto out; - - length = -EFAULT; - if (copy_from_user(data, buf, count) != 0) + } + if (copy_from_user(data, buf, count) != 0) { + length = -EFAULT; goto out; + } length = security_load_policy(fsi->state, data, count); if (length) { @@ -579,6 +581,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, "auid=%u ses=%u lsm=selinux res=1", from_kuid(&init_user_ns, audit_get_loginuid(current)), audit_get_sessionid(current)); + out: mutex_unlock(&fsi->mutex); vfree(data); -- 2.25.1

2 1

[PATCH OLK-6.6] sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
by Liu Jian 19 Dec '24

19 Dec '24

stable inclusion from stable-v6.6.64 commit 3811172e8c98ceebd12fe526ca6cb37a1263c964 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB4JBR Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 4db9ad82a6c823094da27de4825af693a3475d51 ] Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the xs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request() to dereference the transport->sock that has been set to NULL. Fixes: 7196dbb02ea0 ("SUNRPC: Allow changing of the TCP timeout parameters on the fly") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtsock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 50490b1e8a0d0..714da627fba8e 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -1186,6 +1186,7 @@ static void xs_sock_reset_state_flags(struct rpc_xprt *xprt) clear_bit(XPRT_SOCK_WAKE_WRITE, &transport->sock_state); clear_bit(XPRT_SOCK_WAKE_DISCONNECT, &transport->sock_state); clear_bit(XPRT_SOCK_NOSPACE, &transport->sock_state); + clear_bit(XPRT_SOCK_UPD_TIMEOUT, &transport->sock_state); } static void xs_run_error_worker(struct sock_xprt *transport, unsigned int nr) -- 2.34.1

2 3

[PATCH OLK-5.10] sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
by Liu Jian 19 Dec '24

19 Dec '24

mainline inclusion from mainline-v6.13-rc1 commit 3f23f96528e8fcf8619895c4c916c52653892ec1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2WJ7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242 RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d R10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000 R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK> Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Reproduction script: mkdir -p /mnt/nfsshare mkdir -p /mnt/nfs/netns_1 mkfs.ext4 /dev/sdb mount /dev/sdb /mnt/nfsshare systemctl restart nfs-server chmod 777 /mnt/nfsshare exportfs -i -o rw,no_root_squash *:/mnt/nfsshare ip netns add netns_1 ip link add name veth_1_peer type veth peer veth_1 ifconfig veth_1_peer 11.11.0.254 up ip link set veth_1 netns netns_1 ip netns exec netns_1 ifconfig veth_1 11.11.0.1 ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \ --tcp-flags FIN FIN -j DROP (note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.) ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \ 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1 ip netns del netns_1 The reason here is that the tcp socket in netns_1 (nfs side) has been shutdown and closed (done in xs_destroy), but the FIN message (with ack) is discarded, and the nfsd side keeps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends the message (FIN message) in the sending queue, and the tcp timer is re-established. When the network namespace is deleted, the net structure accessed by tcp's timer handler function causes problems. To fix this problem, let's hold netns refcnt for the tcp kernel socket as done in other modules. This is an ugly hack which can easily be backported to earlier kernels. A proper fix which cleans up the interfaces will follow, but may not be so easy to backport. Fixes: 26abe14379f8 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Acked-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: net/sunrpc/svcsock.c net/sunrpc/xprtsock.c [There are no net_trace* functions.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/svcsock.c | 5 +++++ net/sunrpc/xprtsock.c | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 3d5ee042c5015..9b9ac36e24385 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1474,6 +1474,11 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv, newlen = error; if (protocol == IPPROTO_TCP) { + sock->sk->sk_net_refcnt = 1; + get_net(net); +#ifdef CONFIG_PROC_FS + this_cpu_add(*net->core.sock_inuse, 1); +#endif if ((error = kernel_listen(sock, 64)) < 0) goto bummer; } diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 134a90b2216cc..b290fbec93007 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -1857,6 +1857,13 @@ static struct socket *xs_create_sock(struct rpc_xprt *xprt, goto out; } + if (protocol == IPPROTO_TCP) { + sock->sk->sk_net_refcnt = 1; + get_net(xprt->xprt_net); +#ifdef CONFIG_PROC_FS + this_cpu_add(*xprt->xprt_net->core.sock_inuse, 1); +#endif + } filp = sock_alloc_file(sock, O_NONBLOCK, NULL); if (IS_ERR(filp)) return ERR_CAST(filp); -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
by Liu Jian 19 Dec '24

19 Dec '24

mainline inclusion from mainline-v6.13-rc1 commit 3f23f96528e8fcf8619895c4c916c52653892ec1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2WJ7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242 RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d R10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000 R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK> Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Reproduction script: mkdir -p /mnt/nfsshare mkdir -p /mnt/nfs/netns_1 mkfs.ext4 /dev/sdb mount /dev/sdb /mnt/nfsshare systemctl restart nfs-server chmod 777 /mnt/nfsshare exportfs -i -o rw,no_root_squash *:/mnt/nfsshare ip netns add netns_1 ip link add name veth_1_peer type veth peer veth_1 ifconfig veth_1_peer 11.11.0.254 up ip link set veth_1 netns netns_1 ip netns exec netns_1 ifconfig veth_1 11.11.0.1 ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \ --tcp-flags FIN FIN -j DROP (note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.) ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \ 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1 ip netns del netns_1 The reason here is that the tcp socket in netns_1 (nfs side) has been shutdown and closed (done in xs_destroy), but the FIN message (with ack) is discarded, and the nfsd side keeps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends the message (FIN message) in the sending queue, and the tcp timer is re-established. When the network namespace is deleted, the net structure accessed by tcp's timer handler function causes problems. To fix this problem, let's hold netns refcnt for the tcp kernel socket as done in other modules. This is an ugly hack which can easily be backported to earlier kernels. A proper fix which cleans up the interfaces will follow, but may not be so easy to backport. Fixes: 26abe14379f8 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Acked-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: net/sunrpc/svcsock.c net/sunrpc/xprtsock.c [There are no net_trace* functions.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/svcsock.c | 5 +++++ net/sunrpc/xprtsock.c | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index b5ee21d5d1f3a..876becc6526df 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1555,6 +1555,11 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv, newlen = error; if (protocol == IPPROTO_TCP) { + sock->sk->sk_net_refcnt = 1; + get_net(net); +#ifdef CONFIG_PROC_FS + this_cpu_add(*net->core.sock_inuse, 1); +#endif if ((error = kernel_listen(sock, 64)) < 0) goto bummer; } diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 13e0e7aad6bb2..2dd826cd006ee 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2004,6 +2004,14 @@ static struct socket *xs_create_sock(struct rpc_xprt *xprt, goto out; } + if (protocol == IPPROTO_TCP) { + sock->sk->sk_net_refcnt = 1; + get_net(xprt->xprt_net); +#ifdef CONFIG_PROC_FS + this_cpu_add(*xprt->xprt_net->core.sock_inuse, 1); +#endif + } + return sock; out: return ERR_PTR(err); -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/7] fix CVE-2024-53093
by Zheng Qixing 19 Dec '24

19 Dec '24

Fix CVE-2024-53093. Christoph Hellwig (2): nvme: factor out a nvme_tryget_ns_head helper nvme: replace the GENHD_FL_UP check in nvme_mpath_shutdown_disk Daniel Wagner (1): nvme: avoid race in shutdown namespace removal Hannes Reinecke (2): nvme: fix refcounting imbalance when all paths are down nvme-multipath: avoid hang on inaccessible namespaces Keith Busch (1): nvme-multipath: defer partition scanning Zheng Qixing (1): nvme: multipath: fix kabi broken by adding struct nvme_ns_head_wrapper drivers/nvme/host/core.c | 36 ++++++++++++++------ drivers/nvme/host/multipath.c | 64 +++++++++++++++++++++++++++++++++-- drivers/nvme/host/nvme.h | 18 +++++----- fs/block_dev.c | 1 + 4 files changed, 96 insertions(+), 23 deletions(-) -- 2.39.2

2 8

[PATCH OLK-5.10 0/7] fix CVE-2024-53093
by Zheng Qixing 19 Dec '24

19 Dec '24

Fix CVE-2024-53093. Christoph Hellwig (2): nvme: factor out a nvme_tryget_ns_head helper nvme: replace the GENHD_FL_UP check in nvme_mpath_shutdown_disk Daniel Wagner (1): nvme: avoid race in shutdown namespace removal Hannes Reinecke (2): nvme: fix refcounting imbalance when all paths are down nvme-multipath: avoid hang on inaccessible namespaces Keith Busch (1): nvme-multipath: defer partition scanning Zheng Qixing (1): nvme: multipath: fix kabi broken by adding struct nvme_ns_head_wrapper drivers/nvme/host/core.c | 36 ++++++++++++++------ drivers/nvme/host/multipath.c | 64 +++++++++++++++++++++++++++++++++-- drivers/nvme/host/nvme.h | 18 +++++----- fs/block_dev.c | 1 + 4 files changed, 96 insertions(+), 23 deletions(-) -- 2.39.2

2 8