- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] [Backport] SUNRPC: Ensure that the gssproxy client can start in a connected state
by Wang Hai 08 Jul '23

08 Jul '23

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.18-rc7 commit fd13359f54ee854f00134abc6be32da94ec53dbf category: bugfix bugzilla: 186837 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure that the gssproxy client connects to the server from the gssproxy daemon process context so that the AF_LOCAL socket connection is done using the correct path and namespaces. Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> conflict: net/sunrpc/clnt.c Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/auth_gss/gss_rpc_upcall.c | 1 + net/sunrpc/clnt.c | 33 ++++++++++++++++++++++++++++ 3 files changed, 35 insertions(+) diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h index a28300e18fe3..b7b1abe3e048 100644 --- a/include/linux/sunrpc/clnt.h +++ b/include/linux/sunrpc/clnt.h @@ -164,6 +164,7 @@ struct rpc_add_xprt_test { #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) #define RPC_CLNT_CREATE_SOFTERR (1UL << 10) #define RPC_CLNT_CREATE_REUSEPORT (1UL << 11) +#define RPC_CLNT_CREATE_CONNECTED (1UL << 12) struct rpc_clnt *rpc_create(struct rpc_create_args *args); struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c index af9c7f43859c..366968f5b619 100644 --- a/net/sunrpc/auth_gss/gss_rpc_upcall.c +++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c @@ -98,6 +98,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt) * done without the correct namespace: */ .flags = RPC_CLNT_CREATE_NOPING | + RPC_CLNT_CREATE_CONNECTED | RPC_CLNT_CREATE_NO_IDLE_TIMEOUT }; struct rpc_clnt *clnt; diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index 78c6648af782..6fe8cb84638f 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c @@ -75,6 +75,7 @@ static int rpc_encode_header(struct rpc_task *task, static int rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr); static int rpc_ping(struct rpc_clnt *clnt); +static int rpc_ping_noreply(struct rpc_clnt *clnt); static void rpc_check_timeout(struct rpc_task *task); static void rpc_register_client(struct rpc_clnt *clnt) @@ -479,6 +480,12 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args, rpc_shutdown_client(clnt); return ERR_PTR(err); } + } else if (args->flags & RPC_CLNT_CREATE_CONNECTED) { + int err = rpc_ping_noreply(clnt); + if (err != 0) { + rpc_shutdown_client(clnt); + return ERR_PTR(err); + } } clnt->cl_softrtry = 1; @@ -2674,6 +2681,10 @@ static const struct rpc_procinfo rpcproc_null = { .p_decode = rpcproc_decode_null, }; +static const struct rpc_procinfo rpcproc_null_noreply = { + .p_encode = rpcproc_encode_null, +}; + static int rpc_ping(struct rpc_clnt *clnt) { struct rpc_message msg = { @@ -2685,6 +2696,28 @@ static int rpc_ping(struct rpc_clnt *clnt) return err; } +static int rpc_ping_noreply(struct rpc_clnt *clnt) +{ + struct rpc_message msg = { + .rpc_proc = &rpcproc_null_noreply, + }; + struct rpc_task_setup task_setup_data = { + .rpc_client = clnt, + .rpc_message = &msg, + .callback_ops = &rpc_default_ops, + .flags = RPC_TASK_SOFT | RPC_TASK_SOFTCONN | RPC_TASK_NULLCREDS, + }; + struct rpc_task *task; + int status; + + task = rpc_run_task(&task_setup_data); + if (IS_ERR(task)) + return PTR_ERR(task); + status = task->tk_status; + rpc_put_task(task); + return status; +} + static struct rpc_task *rpc_call_null_helper(struct rpc_clnt *clnt, struct rpc_xprt *xprt, struct rpc_cred *cred, int flags, -- 2.33.0

2 1

[PATCH OLK-5.10] dm thin: fix deadlock when swapping to thin device
by Li Lingfeng 08 Jul '23

08 Jul '23

From: Coly Li <colyli(a)suse.de> mainline inclusion from mainline-v6.3-rc4 commit 9bbf5feecc7eab2c370496c1c161bbfe62084028 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7JLUM CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- This is an already known issue that dm-thin volume cannot be used as swap, otherwise a deadlock may happen when dm-thin internal memory demand triggers swap I/O on the dm-thin volume itself. But thanks to commit a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device"), the limit_swap_bios target flag can also be used for dm-thin to avoid the recursive I/O when it is used as swap. Fix is to simply set ti->limit_swap_bios to true in both pool_ctr() and thin_ctr(). In my test, I create a dm-thin volume /dev/vg/swap and use it as swap device. Then I run fio on another dm-thin volume /dev/vg/main and use large --blocksize to trigger swap I/O onto /dev/vg/swap. The following fio command line is used in my test, fio --name recursive-swap-io --lockmem 1 --iodepth 128 \ --ioengine libaio --filename /dev/vg/main --rw randrw \ --blocksize 1M --numjobs 32 --time_based --runtime=12h Without this fix, the whole system can be locked up within 15 seconds. With this fix, there is no any deadlock or hung task observed after 2 hours of running fio. Furthermore, if blocksize is changed from 1M to 128M, after around 30 seconds fio has no visible I/O, and the out-of-memory killer message shows up in kernel message. After around 20 minutes all fio processes are killed and the whole system is back to being alive. This is exactly what is expected when recursive I/O happens on dm-thin volume when it is used as swap. Depends-on: a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device") Cc: stable(a)vger.kernel.org Signed-off-by: Coly Li <colyli(a)suse.de> Acked-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Conflict: drivers/md/dm-thin.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-thin.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index e837839e4def..83ea80774676 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -3379,6 +3379,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) pt->low_water_blocks = low_water_blocks; pt->adjusted_pf = pt->requested_pf = pf; ti->num_flush_bios = 1; + ti->limit_swap_bios = true; /* * Only need to enable discards if the pool should pass @@ -4256,6 +4257,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) goto bad; ti->num_flush_bios = 1; + ti->limit_swap_bios = true; ti->flush_supported = true; ti->per_io_data_size = sizeof(struct dm_thin_endio_hook); -- 2.31.1

2 1

[PATCH OLK-5.10] block: don't set GD_NEED_PART_SCAN if scan partition failed
by Li Lingfeng 08 Jul '23

08 Jul '23

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.3-rc6 commit 3723091ea1884d599cc8b8bf719d6f42e8d4d8b1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7F7J3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently if disk_scan_partitions() failed, GD_NEED_PART_SCAN will still set, and partition scan will be proceed again when blkdev_get_by_dev() is called. However, this will cause a problem that re-assemble partitioned raid device will creat partition for underlying disk. Test procedure: mdadm -CR /dev/md0 -l 1 -n 2 /dev/sda /dev/sdb -e 1.0 sgdisk -n 0:0:+100MiB /dev/md0 blockdev --rereadpt /dev/sda blockdev --rereadpt /dev/sdb mdadm -S /dev/md0 mdadm -A /dev/md0 /dev/sda /dev/sdb Test result: underlying disk partition and raid partition can be observed at the same time Note that this can still happen in come corner cases that GD_NEED_PART_SCAN can be set for underlying disk while re-assemble raid device. Fixes: e5cfefa97bcc ("block: fix scan partition for exclusively open device again") Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/genhd.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/genhd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/genhd.c b/block/genhd.c index 3c34dd011585..83f407e1563a 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -770,6 +770,13 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode) else blkdev_put(bdev, mode & ~FMODE_EXCL); + /* + * If blkdev_get_by_dev() failed early, GD_NEED_PART_SCAN is still set, + * and this will cause that re-assemble partitioned raid device will + * creat partition for underlying disk. + */ + clear_bit(GD_NEED_PART_SCAN, &disk->state); + if (!(mode & FMODE_EXCL)) { bd_abort_claiming(claim, claim, disk_scan_partitions); bdput(claim); -- 2.31.1

2 1

[PATCH 4.19 00/22] linux-4.19.y inclusion part2
by Yongqiang Liu 07 Jul '23

07 Jul '23

Benedict Wong (1): xfrm: Check if_id in inbound policy/secpath match Cambda Zhu (1): tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set Eric Dumazet (7): netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: datagram: fix data-races in datagram_poll() vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() af_packet: do not use READ_ONCE() in packet_bind() rfs: annotate lockless accesses to sk->sk_rxhash rfs: annotate lockless accesses to RFS sock flow table Gavrilov Ilia (1): ipv6: Fix out-of-bounds access in ipv6_find_tlv() Guillaume Nault (1): ping6: Fix send to link-local addresses with VRF. Hangyu Hua (1): net: sched: fix possible refcount leak in tc_chain_tmplt_add() Kuniyuki Iwashima (4): af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). af_packet: Fix data-races of pkt_sk(sk)->num. Nick Child (1): net: Catch invalid index in XPS mapping Nicolas Dichtel (1): ipv{4,6}/raw: fix output xfrm lookup wrt protocol Paolo Abeni (1): tcp: factor out __tcp_close() helper Pratyush Yadav (1): net: fix skb leak in __skb_tstamp_tx() Tobias Brunner (1): af_key: Reject optional tunnel/BEET mode templates in outbound policies Vladislav Efanov (1): udp6: Fix race condition in udp6_sendmsg & connect include/linux/netdevice.h | 7 +++++-- include/net/ip.h | 2 ++ include/net/sock.h | 18 +++++++++++++----- include/net/tcp.h | 1 + include/uapi/linux/in.h | 2 ++ net/8021q/vlan_dev.c | 4 ++-- net/core/datagram.c | 15 ++++++++++----- net/core/dev.c | 8 ++++++-- net/core/skbuff.c | 4 +++- net/core/sock.c | 2 +- net/ipv4/ip_sockglue.c | 12 +++++++++++- net/ipv4/raw.c | 5 ++++- net/ipv4/tcp.c | 12 +++++++++--- net/ipv4/udplite.c | 2 ++ net/ipv6/exthdrs_core.c | 2 ++ net/ipv6/ping.c | 3 ++- net/ipv6/raw.c | 3 ++- net/ipv6/udplite.c | 2 ++ net/key/af_key.c | 12 ++++++++---- net/netlink/af_netlink.c | 8 ++++---- net/packet/af_packet.c | 8 +++++--- net/packet/diag.c | 2 +- net/sched/cls_api.c | 1 + net/socket.c | 2 +- net/unix/af_unix.c | 22 +++++++++++++--------- net/xfrm/xfrm_policy.c | 11 ++++++----- 26 files changed, 118 insertions(+), 52 deletions(-) -- 2.25.1

1 22

[PATCH openEuler-23.09 v1 0/2] Add initial openeuler_defconfig
by Wei Li 07 Jul '23

07 Jul '23

Add initial openeuler_defconfig of arm64 and x86_64, inheritted from openEuler-22.03-LTS-SP2. Wei Li (2): config: arm64: Add initial openeuler_defconfig config: x86_64: Add initial openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 7815 ++++++++++++++++++++ arch/x86/configs/openeuler_defconfig | 9053 ++++++++++++++++++++++++ 2 files changed, 16868 insertions(+) create mode 100644 arch/arm64/configs/openeuler_defconfig create mode 100644 arch/x86/configs/openeuler_defconfig -- 2.25.1

1 2

[PATCH 4.19 1/7] quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse list
by Yongqiang Liu 07 Jul '23

07 Jul '23

From: Chengguang Xu <cgxu519(a)zoho.com.cn> mainline inclusion from mainline-v5.5-rc1 commit 05848db2083d4f232e84e385845dcd98d5c511b2 category: bugfix bugzilla: 188812,https://gitee.com/openeuler/kernel/issues/I7E0YR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is meaningless to increase DQST_LOOKUPS number while iterating over dirty/inuse list, so just avoid it. Link: https://lore.kernel.org/r/20190926083408.4269-1-cgxu519@zoho.com.cn Signed-off-by: Chengguang Xu <cgxu519(a)zoho.com.cn> Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/quota/dquot.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 316f49cbc032..3b02d68d9522 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -589,7 +589,6 @@ int dquot_scan_active(struct super_block *sb, /* Now we have active dquot so we can just increase use count */ atomic_inc(&dquot->dq_count); spin_unlock(&dq_list_lock); - dqstats_inc(DQST_LOOKUPS); dqput(old_dquot); old_dquot = dquot; /* @@ -644,7 +643,6 @@ int dquot_writeback_dquots(struct super_block *sb, int type) * use count */ dqgrab(dquot); spin_unlock(&dq_list_lock); - dqstats_inc(DQST_LOOKUPS); err = sb->dq_op->write_dquot(dquot); if (err) { /* -- 2.25.1

1 6

[PATCH 4.19 00/12] linux-4.19.y inclusion part1
by Yongqiang Liu 07 Jul '23

07 Jul '23

Armin Wolf (1): ACPI: EC: Fix oops when removing custom query handlers Ben Hutchings (1): lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() Damien Le Moal (1): scsi: core: Improve scsi_vpd_inquiry() checks Dave Hansen (1): x86/mm: Avoid incomplete Global INVLPG flushes Eli Cohen (1): lib: cpu_rmap: Avoid use after free on rmap->obj array entries Josh Poimboeuf (1): sched: Fix KCSAN noinstr violation Lukas Wunner (1): PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock Min-Hua Chen (1): arm64/mm: mark private VM_FAULT_X defines as vm_fault_t Nathan Chancellor (1): kernel/extable.c: use address-of operator on section symbols Theodore Ts'o (1): ext4: improve error recovery code paths in __ext4_remount() Tony Lindgren (1): serial: 8250: Reinit port->pm on port specific driver unbind void0red (1): ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects arch/arm64/mm/fault.c | 4 ++-- arch/x86/include/asm/intel-family.h | 5 +++++ arch/x86/mm/init.c | 25 +++++++++++++++++++++++++ drivers/acpi/acpica/dbnames.c | 3 +++ drivers/acpi/ec.c | 1 + drivers/pci/hotplug/pciehp_pci.c | 15 +++++++++++++++ drivers/scsi/scsi.c | 11 +++++++++-- drivers/tty/serial/8250/8250_core.c | 1 + fs/ext4/super.c | 14 +++++++++++--- include/linux/sched/task_stack.h | 2 +- kernel/extable.c | 3 ++- lib/cpu_rmap.c | 5 ++++- 12 files changed, 79 insertions(+), 10 deletions(-) -- 2.25.1

1 12

[PATCH 4.19 0/9] mainline bugfixes backport
by Yongqiang Liu 07 Jul '23

07 Jul '23

Christoph Hellwig (1): block: return -EBUSY when there are open partitions in blkdev_reread_part Eric Biggers (1): random: fix data race on crng_node_pool Salman Qazi (1): block: Limit number of items taken from the I/O scheduler in one go Sebastian Andrzej Siewior (1): crypto: cryptd - Protect per-CPU resource by disabling BH. Siddh Raman Pant (1): loop: Check for overflow while configuring loop Yu Kuai (2): blk-wbt: make enable_state more accurate block: don't set GD_NEED_PART_SCAN if scan partition failed Zhong Jinghua (2): Revert "loop: Check for overflow while configuring loop" loop: loop_set_status_from_info() check before assignment block/blk-mq-sched.c | 66 ++++++++++++++++++++++++++++++++++--------- block/blk-wbt.c | 7 ++++- block/blk-wbt.h | 12 ++++---- block/genhd.c | 6 ++++ block/ioctl.c | 4 +++ crypto/cryptd.c | 23 ++++++++------- drivers/block/loop.c | 10 +++---- drivers/char/random.c | 42 ++++++++++++++------------- 8 files changed, 113 insertions(+), 57 deletions(-) -- 2.25.1

1 9

[PATCH 4.19] x86/kprobes: Fix the error judgment for debug exceptions
by Yongqiang Liu 07 Jul '23

07 Jul '23

From: Li Huafei <lihuafei1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7EU4Q CVE: NA -------------------------------- We get the following crash caused by a null pointer access: <SNIP> BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 54 PID: 2469325 Comm: ftracetest Kdump: loaded Tainted: GFS OE 5.10.0+ #12 Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 3.35 10/20/2016 RIP: 0010:resume_execution+0x35/0x190 Code: 41 54 55 48 89 fd 53 48 89 f3 48 83 ec 08 4c 8b 6f 60 4c 8b b6 98 00 00 00 48 89 14 24 4c 8b 67 28 4d 89 ef eb 04 49 83 c5 01 <41> 0f b6 7d 00 e8 f1 12 57 00 83 e0 0f 8d 48 ff 83 f9 0a 76 e7 83 RSP: 0018:fffffe16118acec0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: fffffe16118acf58 RCX: 00000000eefdca76 RDX: ffff8f8cffd1f400 RSI: fffffe16118acf58 RDI: ffff8f5500d3c000 RBP: ffff8f5500d3c000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff970e39c0 R13: 0000000000000000 R14: ffffb55ba0bd7c60 R15: 0000000000000000 FS: 00002aaaaad22740(0000) GS:ffff8f8cffd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000003ac202c003 CR4: 00000000003706e0 DR0: ffffffff98000160 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <#DB> kprobe_debug_handler+0x41/0xd0 exc_debug+0xe5/0x1b0 asm_exc_debug+0x19/0x30 RIP: 0010:copy_from_kernel_nofault.part.0+0x55/0xc0 Code: 85 c0 74 e1 65 48 8b 04 25 40 f0 01 00 83 a8 78 14 00 00 01 48 c7 c0 f2 ff ff ff c3 cc cc cc cc 48 83 fa 03 76 16 31 c0 8b 0e <89> 0f 85 c0 75 d4 48 83 c7 04 48 83 c6 04 48 83 ea 04 48 83 fa 01 RSP: 0018:ffffb55ba0bd7c60 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000076207325 RDX: 0000000000000004 RSI: ffffffff98000160 RDI: ffff8f5500c0902c RBP: ffff8f5500c0902c R08: ffffb55ba0bd7bdc R09: 0000000000000001 R10: ffff8f5548a0faf8 R11: 0000000000000000 R12: ffffffff98000160 R13: 0000000000000000 R14: ffff8f560da128c0 R15: 0000000000000000 </#DB> process_fetch_insn+0xfb/0x720 kprobe_trace_func+0x199/0x2c0 ? kernel_clone+0x5/0x2f0 kprobe_dispatcher+0x3d/0x60 aggr_pre_handler+0x40/0x80 ? kernel_clone+0x1/0x2f0 kprobe_ftrace_handler+0x82/0xf0 ? __se_sys_clone+0x65/0x90 ftrace_ops_assist_func+0x86/0x110 ? rcu_nocb_try_bypass+0x1f3/0x370 0xffffffffc07e60c8 ? kernel_clone+0x1/0x2f0 kernel_clone+0x5/0x2f0 <SNIP> The analysis reveals that kprobe and hardware breakpoints conflict in the use of debug exceptions. If we set a hardware breakpoint on a memory address, and at the same time there is a kprobe event that also goes to get the memory of that address, then when kprobe triggers, it will go to read the memory and trigger hardware breakpoint monitoring, at this time, because kprobe handles debug exceptions earlier than hardware breakpoints, it will cause kprobe to incorrectly consider this exception as a kprobe trigger. kprobe will change the status from KPROBE_HIT_ACTIVE to KPROBE_HIT_SS or KPROBE_HIT_SSDONE before single-step execution, so if the current status is KPROBE_HIT_ACTIVE, its not a debug exception triggered by kprobe. Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Ye Weihua <yeweihua4(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/kprobes/core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c index d04f670f5262..7a40251a2061 100644 --- a/arch/x86/kernel/kprobes/core.c +++ b/arch/x86/kernel/kprobes/core.c @@ -995,7 +995,15 @@ int kprobe_debug_handler(struct pt_regs *regs) struct kprobe *cur = kprobe_running(); struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); - if (!cur) + if (!cur || !cur->ainsn.insn) + return 0; + + /* kprobe will change the status from KPROBE_HIT_ACTIVE to + * KPROBE_HIT_SS or KPROBE_HIT_SSDONE before single-step execution, so + * if the current status is KPROBE_HIT_ACTIVE, its not a debug + * exception triggered by kprobe. + */ + if (kcb->kprobe_status == KPROBE_HIT_ACTIVE) return 0; resume_execution(cur, regs, kcb); -- 2.25.1

1 0

[PATCH OLK-5.10 v2] dm thin metadata: check fail_io before using data_sm
by Li Lingfeng 07 Jul '23

07 Jul '23

mainline inclusion from mainline-v6.4-rc8 commit cb65b282c9640c27d3129e2e04b711ce1b352838 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7FITX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- Must check pmd->fail_io before using pmd->data_sm since pmd->data_sm may be destroyed by other processes. P1(kworker) P2(message) do_worker process_prepared process_prepared_discard_passdown_pt2 dm_pool_dec_data_range pool_message commit dm_pool_commit_metadata ↓ // commit failed metadata_operation_failed abort_transaction dm_pool_abort_metadata __open_or_format_metadata ↓ dm_sm_disk_open ↓ // open failed // pmd->data_sm is NULL dm_sm_dec_blocks ↓ // try to access pmd->data_sm --> UAF As shown above, if dm_pool_commit_metadata() and dm_pool_abort_metadata() fail in pool_message process, kworker may trigger UAF. Fixes: be500ed721a6 ("dm space maps: improve performance with inc/dec on ranges of blocks") Cc: stable(a)vger.kernel.org Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Conflicts: drivers/md/dm-thin-metadata.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- v1->v2: do not change default return value of dm_pool_inc_data_range and dm_pool_dec_data_range drivers/md/dm-thin-metadata.c | 36 ++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index 85e80fc17641..69401bfac76e 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -1771,13 +1771,15 @@ int dm_thin_remove_range(struct dm_thin_device *td, int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result) { - int r; + int r = -EINVAL; uint32_t ref_count; down_read(&pmd->root_lock); - r = dm_sm_get_count(pmd->data_sm, b, &ref_count); - if (!r) - *result = (ref_count > 1); + if (!pmd->fail_io) { + r = dm_sm_get_count(pmd->data_sm, b, &ref_count); + if (!r) + *result = (ref_count > 1); + } up_read(&pmd->root_lock); return r; @@ -1788,10 +1790,14 @@ int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_ int r = 0; pmd_write_lock(pmd); - for (; b != e; b++) { - r = dm_sm_inc_block(pmd->data_sm, b); - if (r) - break; + if (!pmd->fail_io) { + for (; b != e; b++) { + r = dm_sm_inc_block(pmd->data_sm, b); + if (r) + break; + } + } else { + r = -EINVAL; } pmd_write_unlock(pmd); @@ -1800,13 +1806,17 @@ int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_ int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e) { - int r = 0; + int r = -EINVAL; pmd_write_lock(pmd); - for (; b != e; b++) { - r = dm_sm_dec_block(pmd->data_sm, b); - if (r) - break; + if (!pmd->fail_io) { + for (; b != e; b++) { + r = dm_sm_dec_block(pmd->data_sm, b); + if (r) + break; + } + } else { + r = -EINVAL; } pmd_write_unlock(pmd); -- 2.31.1

2 1

2024

2023

2022

2021

2020

2019

Kernel