- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] block: add check that partition length needs to be aligned with block size
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Min Li <min15.li(a)samsung.com> mainline inclusion from mainline-v6.8-rc1 commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC9 CVE: CVE-2023-52458 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. Cc: <stable(a)vger.kernel.org> Signed-off-by: Min Li <min15.li(a)samsung.com> Reviewed-by: Damien Le Moal <dlemoal(a)kernel.org> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/ioctl.c commit 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") from mainline add check of GENHD_FL_NO_PART; commit 5fb889f587fa ("compat_ioctl: block: simplify compat_blkpg_ioctl()") from mainline remove blkpg_ioctl_arg; commit 1ae011cf0aa0 ("block: Fix the partition start may overflow in add_partition()") from hulk add check of start and length. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index 9d0eeb1b0bbd..1d2b7f701288 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -16,7 +16,7 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user { struct blkpg_ioctl_arg a; struct blkpg_partition p; - long long start, length; + sector_t start, length; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -35,6 +35,9 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) return -EINVAL; + /* Check that the partition is aligned to the block size */ + if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) + return -EINVAL; start = p.start >> SECTOR_SHIFT; length = p.length >> SECTOR_SHIFT; @@ -54,9 +57,6 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user switch (a.op) { case BLKPG_ADD_PARTITION: - /* check if partition is aligned to blocksize */ - if (p.start & (bdev_logical_block_size(bdev) - 1)) - return -EINVAL; return bdev_add_partition(bdev, p.pno, start, length); case BLKPG_RESIZE_PARTITION: return bdev_resize_partition(bdev, p.pno, start, length); -- 2.31.1

2 1

[PATCH] i2c: Fix a potential use after free
by Liu Chuang 27 Feb '24

27 Feb '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

1 0

[PATCH OLK-5.10] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
by Jinjie Ruan 27 Feb '24

27 Feb '24

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v5.10.209 commit ba7be666740847d967822bed15500656b26bc703 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEI CVE: CVE-2024-26598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. Cc: stable(a)vger.kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev --- arch/arm64/kvm/vgic/vgic-its.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index ee3b9df60a59..9c7bd5a8aa35 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -601,7 +601,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, cacheid = cpu % LPI_TRANS_CACHES_NUM; raw_spin_lock_irqsave(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); + irq = __vgic_its_check_cache(dist, db, devid, eventid, cacheid); + if (irq) + vgic_get_irq_kref(irq); + raw_spin_unlock_irqrestore(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); return irq; @@ -778,6 +782,7 @@ static int vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its, raw_spin_lock_irqsave(&irq->irq_lock, flags); irq->pending_latch = true; vgic_queue_irq_unlock(kvm, irq, flags); + vgic_put_irq(kvm, irq); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
by Jinjie Ruan 27 Feb '24

27 Feb '24

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v5.10.209 commit ba7be666740847d967822bed15500656b26bc703 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEI CVE: CVE-2024-26598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. Cc: stable(a)vger.kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- virt/kvm/arm/vgic/vgic-its.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index e9a571673d87..392e02fca470 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -613,7 +613,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, cacheid = cpu % LPI_TRANS_CACHES_NUM; raw_spin_lock_irqsave(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); + irq = __vgic_its_check_cache(dist, db, devid, eventid, cacheid); + if (irq) + vgic_get_irq_kref(irq); + raw_spin_unlock_irqrestore(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); return irq; @@ -809,6 +813,7 @@ int vgic_its_inject_cached_translation(struct kvm *kvm, struct kvm_msi *msi) raw_spin_lock_irqsave(&irq->irq_lock, flags); irq->pending_latch = true; vgic_queue_irq_unlock(kvm, irq, flags); + vgic_put_irq(kvm, irq); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Revert "memcg: fix a UAF problem in drain_all_stock()"
by GONG, Ruiqi 27 Feb '24

27 Feb '24

hulk inclusion category: bugfix bugzilla: 189183, https://gitee.com/openeuler/kernel/issues/I7Z1ZU CVE: NA -------------------------------- This reverts commit 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()"), which was produced based on HULK-7.5 and later was found to be not suitable for HULK-8.1/4.19. Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 29d430885b1a..7dc68b1792ef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2232,7 +2232,8 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) rcu_read_lock(); memcg = stock->cached; - if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; rcu_read_unlock(); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 27 Feb '24

27 Feb '24

From: tangyuchen <tangyuchen5(a)huawei.com> Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 ++++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 37 +++++++++ include/linux/swap.h | 2 + mm/etmem.c | 166 ++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/6] Export vcpu stat via debugfs
by liangtian 27 Feb '24

27 Feb '24

Create debugfs entry for vcpu stat. chenjiajun (6): kvm: debugfs: Export vcpu stat via debugfs kvm: debugfs: export remaining aarch64 kvm exit reasons to debugfs kvm: debugfs: aarch64 export cpu time related items to debugfs kvm: debugfs: Export x86 kvm exits to vcpu_stat kvm: debugfs: add fastpath msr_wr exits to debugfs statistics kvm: debugfs: add EXIT_REASON_PREEMPTION_TIMER to vcpu_stat arch/arm64/Kconfig | 3 + arch/arm64/include/asm/kvm_host.h | 21 ++++ arch/arm64/kvm/arm.c | 31 ++++++ arch/arm64/kvm/guest.c | 40 +++++++- arch/arm64/kvm/handle_exit.c | 8 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 2 + arch/arm64/kvm/mmu.c | 1 + arch/arm64/kvm/sys_regs.c | 9 ++ arch/x86/Kconfig | 3 + arch/x86/include/asm/kvm_host.h | 17 ++++ arch/x86/kvm/vmx/vmx.c | 8 ++ arch/x86/kvm/x86.c | 87 ++++++++++++++++ include/linux/kvm_host.h | 44 ++++++++ include/uapi/linux/kvm.h | 1 + virt/kvm/kvm_main.c | 130 ++++++++++++++++++++++++ 15 files changed, 404 insertions(+), 1 deletion(-) -- 2.33.0

2 7

[PATCH OLK-5.10] block: add check that partition length needs to be aligned with block size
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Min Li <min15.li(a)samsung.com> mainline inclusion from mainline-v6.8-rc1 commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC9 CVE: CVE-2023-52458 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. Cc: <stable(a)vger.kernel.org> Signed-off-by: Min Li <min15.li(a)samsung.com> Reviewed-by: Damien Le Moal <dlemoal(a)kernel.org> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/ioctl.c commit 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") from mainline add check of GENHD_FL_NO_PART; commit 1ae011cf0aa0 ("block: Fix the partition start may overflow in add_partition()") from hulk add check of start and length. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index f2a3524ed0ac..c8945df2e283 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -17,7 +17,7 @@ static int blkpg_do_ioctl(struct block_device *bdev, struct blkpg_partition __user *upart, int op) { struct blkpg_partition p; - long long start, length; + sector_t start, length; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -34,6 +34,9 @@ static int blkpg_do_ioctl(struct block_device *bdev, if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) return -EINVAL; + /* Check that the partition is aligned to the block size */ + if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) + return -EINVAL; start = p.start >> SECTOR_SHIFT; length = p.length >> SECTOR_SHIFT; @@ -53,9 +56,6 @@ static int blkpg_do_ioctl(struct block_device *bdev, switch (op) { case BLKPG_ADD_PARTITION: - /* check if partition is aligned to blocksize */ - if (p.start & (bdev_logical_block_size(bdev) - 1)) - return -EINVAL; return bdev_add_partition(bdev, p.pno, start, length); case BLKPG_RESIZE_PARTITION: return bdev_resize_partition(bdev, p.pno, start, length); -- 2.31.1

2 1

[PATCH OLK-6.6 0/7] Introduce smart halt polling
by liangtian 27 Feb '24

27 Feb '24

Introduce smart halt polling Peng Liang (1): cpuidle: haltpoll: Only check boot_option_idle_override in x86 Xiangyou Xie (6): sched/idle: introduce smart halt polling cpuidle: add cpuidle-haltpoll driver module parameter arm64: Add some definitions of kvm_para* ARM: cpuidle: Add support for cpuidle-haltpoll driver for ARM config: enable CONFIG_CPU_IDLE_GOV_HALTPOLL and CONFIG_HALTPOLL_CPUIDLE for arm arm64: Optimize ttwu IPI arch/arm64/Kconfig | 3 + arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/include/asm/thread_info.h | 2 + arch/arm64/kernel/process.c | 4 ++ drivers/cpuidle/Kconfig | 4 +- drivers/cpuidle/cpuidle-haltpoll.c | 97 ++++++++++++++++++++++---- drivers/cpuidle/governors/haltpoll.c | 6 +- drivers/cpuidle/poll_state.c | 3 + include/asm-generic/kvm_para.h | 1 + include/linux/kernel.h | 1 + kernel/sched/idle.c | 30 +++++++- kernel/sysctl.c | 7 ++ 12 files changed, 142 insertions(+), 19 deletions(-) -- 2.33.0

2 8

[PATCH v1 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation on ARM architecture
by jiangdongxu 27 Feb '24

27 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. shaodenghui (3): iscsi: add member for NUMA aware order workqueue workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance drivers/scsi/iscsi_tcp.c | 9 +++++++++ drivers/scsi/libiscsi.c | 17 ++++++++++++----- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 15 ++++++++++----- 5 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4