- Kernel - mailweb.openeuler.org

[PATCH] delete python2 dependency
by Zhipeng Xie 01 Sep '20

01 Sep '20

Python2 is no longer supported by the upstream community. The dependency on python2 should be removed from the kernel code. Signed-off-by: Zhipeng Xie <xiezhipeng1(a)huawei.com> --- tools/perf/scripts/python/call-graph-from-sql.py | 2 +- tools/perf/scripts/python/export-to-postgresql.py | 2 +- tools/power/pm-graph/bootgraph.py | 2 +- tools/power/pm-graph/sleepgraph.py | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/perf/scripts/python/call-graph-from-sql.py b/tools/perf/scripts/python/call-graph-from-sql.py index b494a67a1c67..099b472df4a2 100644 --- a/tools/perf/scripts/python/call-graph-from-sql.py +++ b/tools/perf/scripts/python/call-graph-from-sql.py @@ -1,4 +1,4 @@ -#!/usr/bin/python2 +#!/usr/bin/python # call-graph-from-sql.py: create call-graph from sql database # Copyright (c) 2014-2017, Intel Corporation. # diff --git a/tools/perf/scripts/python/export-to-postgresql.py b/tools/perf/scripts/python/export-to-postgresql.py index e46f51b17513..e97a03697aa2 100644 --- a/tools/perf/scripts/python/export-to-postgresql.py +++ b/tools/perf/scripts/python/export-to-postgresql.py @@ -171,7 +171,7 @@ import datetime # SELECT * FROM samples_view WHERE event = 'transactions' AND branch_type_name = 'transaction abort'; # # To print a call stack requires walking the call_paths table. For example this python script: -# #!/usr/bin/python2 +# #!/usr/bin/python # # import sys # from PySide.QtSql import * diff --git a/tools/power/pm-graph/bootgraph.py b/tools/power/pm-graph/bootgraph.py index 8ee626c0f6a5..abb4c38f029b 100755 --- a/tools/power/pm-graph/bootgraph.py +++ b/tools/power/pm-graph/bootgraph.py @@ -1,4 +1,4 @@ -#!/usr/bin/python2 +#!/usr/bin/python # # Tool for analyzing boot timing # Copyright (c) 2013, Intel Corporation. diff --git a/tools/power/pm-graph/sleepgraph.py b/tools/power/pm-graph/sleepgraph.py index 0c760478f7d7..420102e2cd08 100755 --- a/tools/power/pm-graph/sleepgraph.py +++ b/tools/power/pm-graph/sleepgraph.py @@ -1,4 +1,4 @@ -#!/usr/bin/python2 +#!/usr/bin/python # # Tool for analyzing suspend/resume timing # Copyright (c) 2013, Intel Corporation. -- 2.18.1

1 0

[PATCH kernel-4.19, openEuler-1.0-LTS, openEuler-20.09] arm64/config: enable TIPC module for openEuler
by Xie XiuQi 31 Aug '20

31 Aug '20

hulk inclusion category: feature feature: TIPC bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1TDS3 The Transparent Inter Process Communication (TIPC) protocol is specially designed for intra cluster communication. This protocol originates from Ericsson where it has been used in carrier grade cluster applications for many years. Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 44a7d1661576..0ca7fd9cfeee 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1459,7 +1459,10 @@ CONFIG_SCTP_COOKIE_HMAC_MD5=y CONFIG_SCTP_COOKIE_HMAC_SHA1=y CONFIG_INET_SCTP_DIAG=m # CONFIG_RDS is not set -# CONFIG_TIPC is not set +CONFIG_TIPC=m +CONFIG_TIPC_MEDIA_IB=y +CONFIG_TIPC_MEDIA_UDP=y +CONFIG_TIPC_DIAG=m CONFIG_ATM=m CONFIG_ATM_CLIP=m # CONFIG_ATM_CLIP_NO_ICMP is not set -- 2.20.1

1 0

[PATCH] kvm: fix compile error when including linux/kvm.h
by Yang Yingliang 29 Aug '20

29 Aug '20

From: Peng Liang <liangpeng10(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA linux/kvm.h should be self-contained so uint64_t should be replaced with __u64. Signed-off-by: Peng Liang <liangpeng10(a)huawei.com> Reviewed-by: zhanghailiang <zhang.zhanghailiang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/uapi/linux/kvm.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index 4bd8e8bcc78e1..6b6eb5b00a385 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -1201,13 +1201,13 @@ struct kvm_vfio_spapr_tce { #define ID_REG_MAX_NUMS 64 struct id_reg_info { - uint64_t sys_id; - uint64_t sys_val; + __u64 sys_id; + __u64 sys_val; }; struct id_registers { struct id_reg_info regs[ID_REG_MAX_NUMS]; - uint64_t num; + __u64 num; }; /* -- 2.25.1

1 0

[PATCH 1/8] Revert "block: rename 'q->debugfs_dir' and 'q->blk_trace->dir' in blk_unregister_queue()"
by Yang Yingliang 29 Aug '20

29 Aug '20

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 30213 CVE: CVE-2019-19770 --------------------------- The UAF in blktrace was fixed by a different approch from mainline, thus revert our solution and backport related patches. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Yufen Yu <yuyufen(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-sysfs.c | 49 ----------------------------------------------- 1 file changed, 49 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index ce84526ed51dd..2d905a8b14730 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -11,7 +11,6 @@ #include <linux/blktrace_api.h> #include <linux/blk-mq.h> #include <linux/blk-cgroup.h> -#include <linux/debugfs.h> #include <linux/atomic.h> #include "blk.h" @@ -960,53 +959,6 @@ int blk_register_queue(struct gendisk *disk) } EXPORT_SYMBOL_GPL(blk_register_queue); -#ifdef CONFIG_DEBUG_FS -void blk_rename_debugfs_dir(struct dentry **old) -{ - static atomic_t i = ATOMIC_INIT(0); - struct dentry *new; - char name[DNAME_INLINE_LEN]; - u32 index = atomic_fetch_inc(&i); - - snprintf(name, sizeof(name), "ready_to_remove_%u", index); - new = debugfs_lookup(name, blk_debugfs_root); - if (WARN_ON(new)) { - dput(new); - return; - } - new = debugfs_rename(blk_debugfs_root, *old, blk_debugfs_root, name); - if (WARN_ON(!new)) - return; - *old = new; -} - -/* - * blk_prepare_release_queue - rename q->debugfs_dir and q->blk_trace->dir - * @q: request_queue of which the dir to be renamed belong to. - * - * Because the final release of request_queue is in a workqueue, the - * cleanup might not been finished yet while the same device start to - * create. It's not correct if q->debugfs_dir still exist while trying - * to create a new one. - */ -static void blk_prepare_release_queue(struct request_queue *q) -{ -#ifdef CONFIG_BLK_DEBUG_FS - if (!IS_ERR_OR_NULL(q->debugfs_dir)) - blk_rename_debugfs_dir(&q->debugfs_dir); - -#endif -#ifdef CONFIG_BLK_DEV_IO_TRACE - mutex_lock(&q->blk_trace_mutex); - if (q->blk_trace && !IS_ERR_OR_NULL(q->blk_trace->dir)) - blk_rename_debugfs_dir(&q->blk_trace->dir); - mutex_unlock(&q->blk_trace_mutex); -#endif -} -#else -#define blk_prepare_release_queue(q) do { } while (0) -#endif - /** * blk_unregister_queue - counterpart of blk_register_queue() * @disk: Disk of which the request queue should be unregistered from sysfs. @@ -1031,7 +983,6 @@ void blk_unregister_queue(struct gendisk *disk) * concurrent elv_iosched_store() calls. */ mutex_lock(&q->sysfs_lock); - blk_prepare_release_queue(q); blk_queue_flag_clear(QUEUE_FLAG_REGISTERED, q); -- 2.25.1

1 7

[PATCH 00/16] ARMv8.3 pointer authentication userspace
by Yang Yingliang 29 Aug '20

29 Aug '20

This series adds support for the ARMv8.3 pointer authentication extension, enabling userspace return address protection with GCC 7 and above. Arnaldo Carvalho de Melo (2): tools beauty: Make the prctl option table generator catch all PR_ options tools headers uapi: Sync prctl.h with the kernel sources Kristina Martsenko (3): arm64: add comments about EC exception levels arm64: add prctl control for resetting ptrauth keys arm64: add ptrace regsets for ptrauth key management Mark Rutland (8): arm64: add pointer authentication register bits arm64/kvm: hide ptrauth from guests arm64/cpufeature: detect pointer authentication arm64: add basic pointer authentication support arm64: expose user PAC bit positions via ptrace arm64: perf: strip PAC when unwinding userspace arm64: enable pointer authentication arm64: docs: document pointer authentication Will Deacon (3): arm64: ptr auth: Move per-thread keys from thread_info to thread_struct arm64: cpufeature: Reduce number of pointer auth CPU caps from 6 to 4 arm64: cpufeature: Rework ptr auth hwcaps using multi_entry_cap_matches Documentation/arm64/booting.txt | 8 + Documentation/arm64/cpu-feature-registers.txt | 8 + Documentation/arm64/elf_hwcaps.txt | 12 ++ .../arm64/pointer-authentication.txt | 93 +++++++++ arch/arm64/Kconfig | 23 +++ arch/arm64/include/asm/cpucaps.h | 6 +- arch/arm64/include/asm/cpufeature.h | 73 +++++-- arch/arm64/include/asm/esr.h | 17 +- arch/arm64/include/asm/pointer_auth.h | 97 +++++++++ arch/arm64/include/asm/processor.h | 7 + arch/arm64/include/asm/sysreg.h | 30 +++ arch/arm64/include/uapi/asm/hwcap.h | 2 + arch/arm64/include/uapi/asm/ptrace.h | 20 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cpu_errata.c | 32 --- arch/arm64/kernel/cpufeature.c | 138 +++++++++++-- arch/arm64/kernel/cpuinfo.c | 2 + arch/arm64/kernel/perf_callchain.c | 6 +- arch/arm64/kernel/pointer_auth.c | 47 +++++ arch/arm64/kernel/process.c | 4 + arch/arm64/kernel/ptrace.c | 185 ++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 18 ++ arch/arm64/kvm/sys_regs.c | 8 + include/uapi/linux/elf.h | 3 + include/uapi/linux/prctl.h | 8 + kernel/sys.c | 8 + tools/include/uapi/linux/prctl.h | 8 + tools/perf/trace/beauty/prctl_option.sh | 2 +- 28 files changed, 789 insertions(+), 77 deletions(-) create mode 100644 Documentation/arm64/pointer-authentication.txt create mode 100644 arch/arm64/include/asm/pointer_auth.h create mode 100644 arch/arm64/kernel/pointer_auth.c -- 2.25.1

1 16

[PATCH kernel-5.5 0/4] Add RISC-V log dirty support
by Yifei Jiang 27 Aug '20

27 Aug '20

euleros inclusion category: feature bugzilla: NA CVE: NA This series supports log dirty for migration in RISC-V KVM. We have implemented the vm migration in Qemu, So these patches have been tested and are valid. Link: https://gitee.com/openeuler/kernel/issues/I1SWY2 Yifei Jiang (4): riscv/kvm: Fix use VSIP_VALID_MASK mask HIP register riscv/kvm: add kvm_arch_mmu_enable_log_dirty_pt_masked riscv/kvm: implement kvm_vm_ioctl_get_dirty_log riscv/kvm: Add kvm_vm_ioctl_clear_dirty_log arch/riscv/configs/defconfig | 1 + arch/riscv/kvm/Kconfig | 1 + arch/riscv/kvm/mmu.c | 37 +++++++++++++++++++++++++++ arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/kvm/vm.c | 49 ++++++++++++++++++++++++++++++++++-- 5 files changed, 87 insertions(+), 3 deletions(-) -- 2.19.1

3 7

[PATCH] ACPI: GED: fix replace timer with delayed work
by huangjun 27 Aug '20

27 Aug '20

From: Jun Huang <huangjun63(a)huawei.com> The acpi_execute_simple_method function uses a mutex, so it cannot be called in the timer. We replace timer with delayed work. Signed-off-by: Jun Huang <huangjun63(a)huawei.com> --- drivers/acpi/evged.c | 60 ++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 33 deletions(-) diff --git a/drivers/acpi/evged.c b/drivers/acpi/evged.c index 7354d8d..5bf65b1 100644 --- a/drivers/acpi/evged.c +++ b/drivers/acpi/evged.c @@ -34,7 +34,7 @@ * Method (_EVT, 1) { * if (Lequal(123, Arg0)) * { - * } + * }# * } * } * @@ -46,20 +46,23 @@ #include <linux/list.h> #include <linux/platform_device.h> #include <linux/acpi.h> -#include <linux/timer.h> #include <linux/jiffies.h> +#include <linux/workqueue.h> #define MODULE_NAME "acpi-ged" +static void gpp_enable_pwd(struct work_struct *private_); + +static DECLARE_DELAYED_WORK(gpp_work, gpp_enable_pwd); + struct acpi_ged_handle { - struct timer_list timer; /* For 4s anti-shake of power button */ acpi_handle gpp_handle; /* ACPI Handle: enable shutdown */ acpi_handle gpo_handle; /* ACPI Handle: set sleep flag */ }; struct acpi_ged_device { struct device *dev; - struct acpi_ged_handle *wakeup_handle; + struct acpi_ged_handle *ged_handle; struct list_head event_list; }; @@ -71,6 +74,8 @@ struct acpi_ged_event { acpi_handle handle; }; +static struct acpi_ged_handle *wakeup_handle; + static irqreturn_t acpi_ged_irq_handler(int irq, void *data) { struct acpi_ged_event *event = data; @@ -142,7 +147,6 @@ static acpi_status acpi_ged_request_interrupt(struct acpi_resource *ares, #ifdef CONFIG_PM_SLEEP static void init_ged_handle(struct acpi_ged_device *geddev) { - struct acpi_ged_handle *wakeup_handle; acpi_handle gpo_handle = NULL; acpi_handle gpp_handle = NULL; acpi_status acpi_ret; @@ -151,10 +155,7 @@ static void init_ged_handle(struct acpi_ged_device *geddev) { if (!wakeup_handle) return; - geddev->wakeup_handle = wakeup_handle; - - /* Initialize wakeup_handle, prepare for ged suspend and resume */ - timer_setup(&wakeup_handle->timer, NULL, 0); + geddev->ged_handle = wakeup_handle; acpi_ret = acpi_get_handle(ACPI_HANDLE(geddev->dev), "_GPO", &gpo_handle); if (ACPI_FAILURE(acpi_ret)) @@ -204,8 +205,6 @@ static void ged_shutdown(struct platform_device *pdev) dev_dbg(geddev->dev, "GED releasing GSI %u @ IRQ %u\n", event->gsi, event->irq); } - if (geddev->wakeup_handle) - del_timer(&geddev->wakeup_handle->timer); } static int ged_remove(struct platform_device *pdev) @@ -220,23 +219,10 @@ static const struct acpi_device_id ged_acpi_ids[] = { }; #ifdef CONFIG_PM_SLEEP -static void ged_timer_callback(struct timer_list *t) -{ - struct acpi_ged_handle *wakeup_handle = from_timer(wakeup_handle, t, timer); - acpi_status acpi_ret; - - /* _GPP method enable power button */ - if (wakeup_handle && wakeup_handle->gpp_handle) { - acpi_ret = acpi_execute_simple_method(wakeup_handle->gpp_handle, NULL, ACPI_IRQ_MODEL_GIC); - if (ACPI_FAILURE(acpi_ret)) - pr_warn("_GPP method execution failed\n"); - } -} - static int ged_suspend(struct device *dev) { struct acpi_ged_device *geddev = dev_get_drvdata(dev); - struct acpi_ged_handle *wakeup_handle = geddev->wakeup_handle; + //struct acpi_ged_handle *wakeup_handle = geddev->wakeup_handle; struct acpi_ged_event *event, *next; acpi_status acpi_ret; @@ -255,18 +241,26 @@ static int ged_suspend(struct device *dev) return 0; } +static void gpp_enable_pwd(struct work_struct *private_) +{ + acpi_status acpi_ret; + + /* _GPP method enable power button */ + if (wakeup_handle && wakeup_handle->gpp_handle) { + acpi_ret = acpi_execute_simple_method(wakeup_handle->gpp_handle, NULL, ACPI_IRQ_MODEL_GIC); + if (ACPI_FAILURE(acpi_ret)) + pr_warn("_GPP method execution failed\n"); + } + +} + static int ged_resume(struct device *dev) { struct acpi_ged_device *geddev = dev_get_drvdata(dev); - struct acpi_ged_handle *wakeup_handle = geddev->wakeup_handle; struct acpi_ged_event *event, *next; - - /* use timer to complete 4s anti-shake */ - if (wakeup_handle && wakeup_handle->gpp_handle) { - wakeup_handle->timer.expires = jiffies + (4 * HZ); - wakeup_handle->timer.function = ged_timer_callback; - add_timer(&wakeup_handle->timer); - } + + /* use delayed_work to complete 4s anti-shake */ + schedule_delayed_work(&gpp_work, 4 * HZ); list_for_each_entry_safe(event, next, &geddev->event_list, node) disable_irq_wake(event->irq); -- 2.23.0.windows.1

1 0

[PATCH 0/2] Add risc-v vhost-net support
by Yifei Jiang 26 Aug '20

26 Aug '20

euleros inclusion category: feature bugzilla: NA CVE: NA These two patches enable the support for vhost-net on RISC-V architecture. The following two steps are performed to run a vm with vhost-net: 1. create virbr0 on riscv64 emulation $ brctl addbr virbr0 $ brctl stp virbr0 on $ ifconfig virbr0 up $ ifconfig virbr0 virbr0_ip netmask 255.255.255.0 2. boot a riscv64 guest OS on riscv64 emulation $ ./qemu-system-riscv64 -M virt,accel=kvm -m 1024M -cpu host -nographic \ -name guest=riscv-guest \ -smp 2 \ -kernel ./Image \ -drive file=./guest.img,format=raw,id=hd0 \ -device virtio-blk,drive=hd0 \ -netdev type=tap,vhost=on,script=./ifup.sh,downscript=./ifdown.sh,id=net0 \ -append "root=/dev/vda rw console=ttyS0 earlycon=sbi" $ cat ifup.sh #!/bin/sh brctl addif virbr0 $1 ifconfig $1 up $ cat ifdown.sh #!/bin/sh ifconfig $1 down brctl delif virbr0 $1 This brenchmark netperf is used to test the performance of vhost-net and virtio-net. The results are as follow: $ ./netperf -H virbr0_ip -l 100 -t TCP_STREAM vhost-net: Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 131072 16384 16384 100.06 521.62 virtio-net: Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 131072 16384 16384 292.86 292.86 Link: https://gitee.com/openeuler/kernel/issues/I1SQJ2 Yifei Jiang (2): RISC-V: KVM: enable ioeventfd capability RISC-V: KVM: kernel mmio read/write support arch/riscv/kvm/Kconfig | 2 ++ arch/riscv/kvm/Makefile | 2 +- arch/riscv/kvm/vcpu_exit.c | 28 ++++++++++++++++++++++++++-- arch/riscv/kvm/vm.c | 1 + 4 files changed, 30 insertions(+), 3 deletions(-) -- 2.19.1

3 4

[PATCH 1/4] can: j1939: fix support for multipacket broadcast message
by Yang Yingliang 25 Aug '20

25 Aug '20

From: Zhang Changzhong <zhangchangzhong(a)huawei.com> mainline inclusion from mainline-v5.9-rc2 commit f4fd77fd87e9b214c26bb2ebd4f90055eaea5ade category: bugfix bugzilla: 39990 CVE: NA --------------------------- Currently j1939_tp_im_involved_anydir() in j1939_tp_recv() check the previously set flags J1939_ECU_LOCAL_DST and J1939_ECU_LOCAL_SRC of incoming skb, thus multipacket broadcast message was aborted by receive side because it may come from remote ECUs and have no exact dst address. Similarly, j1939_tp_cmd_recv() and j1939_xtp_rx_dat() didn't process broadcast message. So fix it by checking and process broadcast message in j1939_tp_recv(), j1939_tp_cmd_recv() and j1939_xtp_rx_dat(). Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Link: https://lore.kernel.org/r/1596599425-5534-2-git-send-email-zhangchangzhong@… Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/can/j1939/transport.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index 9f99af5b0b11e..e5188acbb1db7 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1651,8 +1651,12 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb, return; } session = j1939_xtp_rx_rts_session_new(priv, skb); - if (!session) + if (!session) { + if (cmd == J1939_TP_CMD_BAM && j1939_sk_recv_match(priv, skcb)) + netdev_info(priv->ndev, "%s: failed to create TP BAM session\n", + __func__); return; + } } else { if (j1939_xtp_rx_rts_session_active(session, skb)) { j1939_session_put(session); @@ -1829,6 +1833,13 @@ static void j1939_xtp_rx_dat(struct j1939_priv *priv, struct sk_buff *skb) else j1939_xtp_rx_dat_one(session, skb); } + + if (j1939_cb_is_broadcast(skcb)) { + session = j1939_session_get_by_addr(priv, &skcb->addr, false, + false); + if (session) + j1939_xtp_rx_dat_one(session, skb); + } } /* j1939 main intf */ @@ -1920,7 +1931,7 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb) if (j1939_tp_im_transmitter(skcb)) j1939_xtp_rx_rts(priv, skb, true); - if (j1939_tp_im_receiver(skcb)) + if (j1939_tp_im_receiver(skcb) || j1939_cb_is_broadcast(skcb)) j1939_xtp_rx_rts(priv, skb, false); break; @@ -1984,7 +1995,7 @@ int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff *skb) { struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb); - if (!j1939_tp_im_involved_anydir(skcb)) + if (!j1939_tp_im_involved_anydir(skcb) && !j1939_cb_is_broadcast(skcb)) return 0; switch (skcb->addr.pgn) { -- 2.25.1

1 3

[RESEND,PATCH 0/7] Improvements and fixes
by Roberto Sassu 25 Aug '20

25 Aug '20

Resending due to conflicts with existing code. This patch set provides some improvements and fixes. The first three patches solve a permission problem caused by EVM. EVM denies xattr operations also for files that are not appraised by IMA. If only executables are appraised, xattr operations on the other files should be allowed, even if metadata verification fails (for example due to missing security.evm). At the moment, in openEuler we use EVM_ALLOW_METADATA_WRITES to avoid this problem (EVM does not check metadata integrity), but it would be useful to do the verification for example to prevent accidental changes on immutable metadata. The fourth patch enables the choice of the algorithm for the HMAC and ensures that the parameters passed to the functions which handle the HMAC are consistent with the algorithm chosen. The last three patches are simple bug fixes. Roberto Sassu (7): evm: Move hooks outside LSM infrastructure evm: Extend API of post hooks to pass the result of pre hooks evm: Return -EAGAIN to ignore verification failures evm: Propagate choice of HMAC algorithm in evm_crypto.c ima: Fix datalen check in ima_write_data() evm: Fix validation of fake xattr passed by IMA evm: Initialize saved_evm_status fs/attr.c | 7 ++- fs/xattr.c | 65 +++++++++++++++++--------- include/linux/evm.h | 18 +++++--- security/integrity/evm/Kconfig | 32 +++++++++++++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 15 ++++-- security/integrity/evm/evm_main.c | 71 +++++++++++++++++++++-------- security/integrity/ima/ima_fs.c | 2 +- security/integrity/integrity.h | 2 +- security/security.c | 18 ++------ 10 files changed, 159 insertions(+), 72 deletions(-) -- 2.27.GIT

2 8

2024

2023

2022

2021

2020

2019

Kernel