- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] tcp: restrict net.ipv4.tcp_app_win
by YueHaibing 06 Jun '23

06 Jun '23

mainline inclusion from mainline-v6.3-rc7 commit dc5110c2d959c1707e12df5f792f41d90614adaa category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6WB6P Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- UBSAN: shift-out-of-bounds in net/ipv4/tcp_input.c:555:23 shift exponent 255 is too large for 32-bit type 'int' CPU: 1 PID: 7907 Comm: ssh Not tainted 6.3.0-rc4-00161-g62bad54b26db-dirty #206 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x136/0x150 __ubsan_handle_shift_out_of_bounds+0x21f/0x5a0 tcp_init_transfer.cold+0x3a/0xb9 tcp_finish_connect+0x1d0/0x620 tcp_rcv_state_process+0xd78/0x4d60 tcp_v4_do_rcv+0x33d/0x9d0 __release_sock+0x133/0x3b0 release_sock+0x58/0x1b0 'maxwin' is int, shifting int for 32 or more bits is undefined behaviour. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> --- Documentation/networking/ip-sysctl.rst | 2 ++ net/ipv4/sysctl_net_ipv4.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst index 0158dff63887..df26cf4110ef 100644 --- a/Documentation/networking/ip-sysctl.rst +++ b/Documentation/networking/ip-sysctl.rst @@ -272,6 +272,8 @@ tcp_app_win - INTEGER Reserve max(window/2^tcp_app_win, mss) of window for application buffer. Value 0 is special, it means that nothing is reserved. + Possible values are [0, 31], inclusive. + Default: 31 tcp_autocorking - BOOLEAN diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index dee47ef05655..029f46584203 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -37,6 +37,7 @@ static int ip_local_port_range_min[] = { 1, 1 }; static int ip_local_port_range_max[] = { 65535, 65535 }; static int tcp_adv_win_scale_min = -31; static int tcp_adv_win_scale_max = 31; +static int tcp_app_win_max = 31; static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS; static int tcp_min_snd_mss_max = 65535; static int ip_privileged_port_min; @@ -1156,7 +1157,9 @@ static struct ctl_table ipv4_net_table[] = { .data = &init_net.ipv4.sysctl_tcp_app_win, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = &tcp_app_win_max, }, { .procname = "tcp_adv_win_scale", -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] ubi: Fix deadlock caused by recursively holding work_sem
by ZhaoLong Wang 06 Jun '23

06 Jun '23

Fix deadlock caused by recursively holding work_sem Lee Jones (1): mtd: ubi: wl: Fix a couple of kernel-doc issues ZhaoLong Wang (1): ubi: Fix deadlock caused by recursively holding work_sem drivers/mtd/ubi/wl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-22.03-LTS v2 0/2] xfs: missing lts patchs
by Long Li 06 Jun '23

06 Jun '23

Dave Chinner (2): xfs: reorder iunlink remove operation in xfs_ifree xfs: validate inode fork size against fork format fs/xfs/libxfs/xfs_inode_buf.c | 35 ++++++++++++++++++++++++++--------- fs/xfs/xfs_inode.c | 22 ++++++++++++---------- 2 files changed, 38 insertions(+), 19 deletions(-) -- 2.31.1

2 3

[PATCH OLK-5.10 v2 00/18] xfs: rework feature flags
by Long Li 06 Jun '23

06 Jun '23

2 19

[PATCH OLK-5.10] hikey9xx: Fixed incorrect use of kfree to free sreg
by ZhaoLong Wang 06 Jun '23

06 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GS86 CVE: NA -------------------------------- When memory allocated by using the devm_kmalloc(). the matching release function should use the devm_kfree() function instead of the kfree() function. @sreg allocated: hi6421_spmi_regulator_probe hi6421_spmi_regulator_probe_ldo @sreg freed: hi6421_spmi_regulator_remove Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/staging/hikey9xx/hi6421v600-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/hikey9xx/hi6421v600-regulator.c b/drivers/staging/hikey9xx/hi6421v600-regulator.c index 614b03c9ddfb..63204e460f53 100644 --- a/drivers/staging/hikey9xx/hi6421v600-regulator.c +++ b/drivers/staging/hikey9xx/hi6421v600-regulator.c @@ -452,7 +452,7 @@ static int hi6421_spmi_regulator_remove(struct platform_device *pdev) if (rdev->desc->volt_table) devm_kfree(&pdev->dev, (unsigned int *)rdev->desc->volt_table); - kfree(sreg); + devm_kfree(&pdev->dev, sreg); return 0; } -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] ubi: Fix deadlock caused by recursively
by ZhaoLong Wang 06 Jun '23

06 Jun '23

Fix deadlock caused by recursively holding work_semg Lee Jones (1): mtd: ubi: wl: Fix a couple of kernel-doc issues ZhaoLong Wang (1): ubi: Fix deadlock caused by recursively holding work_sem drivers/mtd/ubi/wl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.31.1

2 4

[PATCH OLK-5.10] tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
by Lu Wei 06 Jun '23

06 Jun '23

stable inclusion from stable-v5.10.155 commit 02f8dfee7580b65449a67baa65cc2da4e5ffc473 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5ZG7O Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0c175da7b0378445f5ef53904247cfbfb87e0b78 ] If setsockopt with option name of TCP_REPAIR_OPTIONS and opt_code of TCPOPT_SACK_PERM is called to enable sack after data is sent and dupacks are received , it will trigger a warning in function tcp_verify_left_out() as follows: ============================================ WARNING: CPU: 8 PID: 0 at net/ipv4/tcp_input.c:2132 tcp_timeout_mark_lost+0x154/0x160 tcp_enter_loss+0x2b/0x290 tcp_retransmit_timer+0x50b/0x640 tcp_write_timer_handler+0x1c8/0x340 tcp_write_timer+0xe5/0x140 call_timer_fn+0x3a/0x1b0 __run_timers.part.0+0x1bf/0x2d0 run_timer_softirq+0x43/0xb0 __do_softirq+0xfd/0x373 __irq_exit_rcu+0xf6/0x140 The warning is caused in the following steps: 1. a socket named socketA is created 2. socketA enters repair mode without build a connection 3. socketA calls connect() and its state is changed to TCP_ESTABLISHED directly 4. socketA leaves repair mode 5. socketA calls sendmsg() to send data, packets_out and sack_outs(dup ack receives) increase 6. socketA enters repair mode again 7. socketA calls setsockopt with TCPOPT_SACK_PERM to enable sack 8. retransmit timer expires, it calls tcp_timeout_mark_lost(), lost_out increases 9. sack_outs + lost_out > packets_out triggers since lost_out and sack_outs increase repeatly In function tcp_timeout_mark_lost(), tp->sacked_out will be cleared if Step7 not happen and the warning will not be triggered. As suggested by Denis and Eric, TCP_REPAIR_OPTIONS should be prohibited if data was already sent. socket-tcp tests in CRIU has been tested as follows: $ sudo ./test/zdtm.py run -t zdtm/static/socket-tcp* --keep-going \ --ignore-taint socket-tcp* represent all socket-tcp tests in test/zdtm/static/. Fixes: b139ba4e90dc ("tcp: Repair connection-time negotiated parameters") Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index e7ac3555d798..f009d78460b4 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3295,7 +3295,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, case TCP_REPAIR_OPTIONS: if (!tp->repair) err = -EINVAL; - else if (sk->sk_state == TCP_ESTABLISHED) + else if (sk->sk_state == TCP_ESTABLISHED && !tp->bytes_sent) err = tcp_repair_options_est(sk, optval, optlen); else err = -EPERM; -- 2.31.1

1 0

[PATCH OLK-5.10 1/2] mtd: ubi: wl: Fix a couple of kernel-doc issues
by ZhaoLong Wang 06 Jun '23

06 Jun '23

From: Lee Jones <lee.jones(a)linaro.org> mainline inclusion from mainline-v5.11-rc1 commit ab4e4de9fd8b469823a645f05f2c142e9270b012 category: bugfix bugzilla: 188441 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes the following W=1 kernel build warning(s): drivers/mtd/ubi/wl.c:584: warning: Function parameter or member 'nested' not described in 'schedule_erase' drivers/mtd/ubi/wl.c:1075: warning: Excess function parameter 'shutdown' description in '__erase_worker' Cc: Richard Weinberger <richard(a)nod.at> Cc: Miquel Raynal <miquel.raynal(a)bootlin.com> Cc: Vignesh Raghavendra <vigneshr(a)ti.com> Cc: linux-mtd(a)lists.infradead.org Signed-off-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20201109182206.3037326-13-lee.jones@linar… Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> --- drivers/mtd/ubi/wl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 6da09263e0b9..2ee0e60c43c2 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -575,6 +575,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, * @vol_id: the volume ID that last used this PEB * @lnum: the last used logical eraseblock number for the PEB * @torture: if the physical eraseblock has to be tortured + * @nested: denotes whether the work_sem is already held in read mode * * This function returns zero in case of success and a %-ENOMEM in case of * failure. @@ -1066,8 +1067,6 @@ static int ensure_wear_leveling(struct ubi_device *ubi, int nested) * __erase_worker - physical eraseblock erase worker function. * @ubi: UBI device description object * @wl_wrk: the work object - * @shutdown: non-zero if the worker has to free memory and exit - * because the WL sub-system is shutting down * * This function erases a physical eraseblock and perform torture testing if * needed. It also takes care about marking the physical eraseblock bad if -- 2.31.1

1 1

退订
by 嚄薅鋽 06 Jun '23

06 Jun '23

退订

1 0

[PATCH OLK-5.10 0/4] icost bugfix
by linan666＠huaweicloud.com 06 Jun '23

06 Jun '23

From: Li Nan <linan122(a)huawei.com> This patch series fix iocost bug. Li Nan (1): blk-iocost: fix UAF in ioc_pd_free Yu Kuai (3): blk-iocost: track whether iocg is still online blk-iocost: don't throttle bio if iocg is offlined blk-iocost: dispatch all throttled bio in ioc_pd_offline block/blk-iocost.c | 57 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 12 deletions(-) -- 2.39.2

1 4