From: Jeongjun Park <aha310510(a)gmail.com>
stable inclusion
from stable-v4.19.325
commit 3c20b5948f119ae61ee35ad8584d666020c91581
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB9NOX
CVE: CVE-2024-53141
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit 35f56c554eb1b56b77b3cf197a6b00922d49033d upstream.
When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,
the values of ip and ip_to are slightly swapped. Therefore, the range check
for ip should be done later, but this part is missing and it seems that the
vulnerability occurs.
So we should add missing range checks and remove unnecessary range checks.
Cc: <stable(a)vger.kernel.org>
Reported-by: syzbot+58c872f7790a4d2ac951(a)syzkaller.appspotmail.com
Fixes: 72205fc68bd1 ("netfilter: ipset: bitmap:ip set type support")
Signed-off-by: Jeongjun Park <aha310510(a)gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec(a)blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
net/netfilter/ipset/ip_set_bitmap_ip.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index e3257077158f..49a6eec6f12f 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -166,11 +166,8 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[],
ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
if (ret)
return ret;
- if (ip > ip_to) {
+ if (ip > ip_to)
swap(ip, ip_to);
- if (ip < map->first_ip)
- return -IPSET_ERR_BITMAP_RANGE;
- }
} else if (tb[IPSET_ATTR_CIDR]) {
u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
@@ -181,7 +178,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[],
ip_to = ip;
}
- if (ip_to > map->last_ip)
+ if (ip < map->first_ip || ip_to > map->last_ip)
return -IPSET_ERR_BITMAP_RANGE;
for (; !before(ip_to, ip); ip += map->hosts) {
--
2.25.1
mainline inclusion
from mainline-v6.13-rc2
commit c44daa7e3c73229f7ac74985acb8c7fb909c4e0a
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB515T
CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
arp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:
WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:ip_rt_bug+0x14/0x20
Call Trace:
<IRQ>
ip_send_skb+0x14/0x40
__icmp_send+0x42d/0x6a0
ipv4_link_failure+0xe2/0x1d0
arp_error_report+0x3c/0x50
neigh_invalidate+0x8d/0x100
neigh_timer_handler+0x2e1/0x330
call_timer_fn+0x21/0x120
__run_timer_base.part.0+0x1c9/0x270
run_timer_softirq+0x4c/0x80
handle_softirqs+0xac/0x280
irq_exit_rcu+0x62/0x80
sysvec_apic_timer_interrupt+0x77/0x90
The script below reproduces this scenario:
ip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \
dir out priority 0 ptype main flag localok icmp
ip l a veth1 type veth
ip a a 192.168.141.111/24 dev veth0
ip l s veth0 up
ping 192.168.141.155 -c 1
icmp_route_lookup() create input routes for locally generated packets
while xfrm relookup ICMP traffic.Then it will set input route
(dst->out = ip_rt_bug) to skb for DESTUNREACH.
For ICMP err triggered by locally generated packets, dst->dev of output
route is loopback. Generally, xfrm relookup verification is not required
on loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1).
Skip icmp relookup for locally generated packets to fix it.
Fixes: 8b7817f3a959 ("[IPSEC]: Add ICMP host relookup support")
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
Reviewed-by: David Ahern <dsahern(a)kernel.org>
Reviewed-by: Eric Dumazet <edumazet(a)google.com>
Link: https://patch.msgid.link/20241127040850.1513135-1-dongchenchen2@huawei.com
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
Conflicts:
net/ipv4/icmp.c
[commit 913c83a610bb("ipv4: Convert icmp_route_lookup() to dscp_t") wasnt
merged, which lead to context conflicts]
Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com>
---
net/ipv4/icmp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 4cbc1bb85ac0..e03003a9c6b0 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -525,6 +525,9 @@ static struct rtable *icmp_route_lookup(struct net *net,
if (!IS_ERR(rt)) {
if (rt != rt2)
return rt;
+ if (inet_addr_type_dev_table(net, route_lookup_dev,
+ fl4->daddr) == RTN_LOCAL)
+ return rt;
} else if (PTR_ERR(rt) == -EPERM) {
rt = NULL;
} else
--
2.25.1
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 6c3413fbf8c430b89f5d23f465e10e99ea145199
commit: 00d37128abe2687fac974c5d21aa67fac6518c7c [2579/2579] sched: Introduce smart grid scheduling strategy for cfs
config: arm64-randconfig-004-20241213 (https://download.01.org/0day-ci/archive/20241214/202412141149.8BSY27XL-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241214/202412141149.8BSY27XL-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412141149.8BSY27XL-lkp@intel.com/
All errors (new ones prefixed by >>):
kernel/sched/core.c:2746:6: warning: no previous prototype for 'sched_set_stop_task' [-Wmissing-prototypes]
2746 | void sched_set_stop_task(int cpu, struct task_struct *stop)
| ^~~~~~~~~~~~~~~~~~~
kernel/sched/core.c: In function 'sched_cpu_activate':
kernel/sched/core.c:8012:9: error: implicit declaration of function 'tg_update_affinity_domains'; did you mean 'irq_update_affinity_desc'? [-Werror=implicit-function-declaration]
8012 | tg_update_affinity_domains(cpu, 1);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
| irq_update_affinity_desc
kernel/sched/core.c: In function 'sched_init_smp':
kernel/sched/core.c:8146:9: error: implicit declaration of function 'init_auto_affinity'; did you mean 'irq_set_affinity'? [-Werror=implicit-function-declaration]
8146 | init_auto_affinity(&root_task_group);
| ^~~~~~~~~~~~~~~~~~
| irq_set_affinity
>> kernel/sched/core.c:8146:29: error: 'root_task_group' undeclared (first use in this function); did you mean 'task_group'?
8146 | init_auto_affinity(&root_task_group);
| ^~~~~~~~~~~~~~~
| task_group
kernel/sched/core.c:8146:29: note: each undeclared identifier is reported only once for each function it appears in
cc1: some warnings being treated as errors
Kconfig warnings: (for reference only)
WARNING: unmet direct dependencies detected for PGP_KEY_PARSER
Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n]
Selected by [y]:
- PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y]
vim +8146 kernel/sched/core.c
8121
8122 void __init sched_init_smp(void)
8123 {
8124 sched_init_numa();
8125 set_sched_cluster();
8126
8127 /*
8128 * There's no userspace yet to cause hotplug operations; hence all the
8129 * CPU masks are stable and all blatant races in the below code cannot
8130 * happen.
8131 */
8132 mutex_lock(&sched_domains_mutex);
8133 sched_init_domains(cpu_active_mask);
8134 mutex_unlock(&sched_domains_mutex);
8135
8136 /* Move init over to a non-isolated CPU */
8137 if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0)
8138 BUG();
8139 sched_init_granularity();
8140
8141 init_sched_rt_class();
8142 init_sched_dl_class();
8143
8144 sched_smp_initialized = true;
8145
> 8146 init_auto_affinity(&root_task_group);
8147 }
8148
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: d68dc6ee371ec5466be9b2d76bdca0b360940adc
commit: 48fb9af1d04848a2583b2dbf3b7091eca38dd482 [1636/1636] mm: Enhanced copy capabilities for Hygon processor
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241214/202412140911.UsV56v7f-lkp@…)
compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241214/202412140911.UsV56v7f-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412140911.UsV56v7f-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> arch/x86/kernel/cpu/hygon.c:480:6: warning: no previous prototype for function 'set_c86_features_para_invalid' [-Wmissing-prototypes]
480 | void set_c86_features_para_invalid(void)
| ^
arch/x86/kernel/cpu/hygon.c:480:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
480 | void set_c86_features_para_invalid(void)
| ^
| static
>> arch/x86/kernel/cpu/hygon.c:485:14: warning: no previous prototype for function 'get_nt_block_copy_mini_len' [-Wmissing-prototypes]
485 | unsigned int get_nt_block_copy_mini_len(void)
| ^
arch/x86/kernel/cpu/hygon.c:485:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
485 | unsigned int get_nt_block_copy_mini_len(void)
| ^
| static
2 warnings generated.
--
In file included from arch/x86/kernel/fpu/core.c:14:
In file included from arch/x86/include/asm/traps.h:6:
In file included from include/linux/kprobes.h:28:
In file included from include/linux/ftrace.h:13:
In file included from include/linux/kallsyms.h:13:
In file included from include/linux/mm.h:2242:
include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
509 | item];
| ~~~~
include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
516 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
| ~~~~~~~~~~~ ^ ~~~
include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
528 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
537 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
>> arch/x86/kernel/fpu/core.c:466:14: warning: no previous prototype for function 'get_fpustate_free_space' [-Wmissing-prototypes]
466 | unsigned int get_fpustate_free_space(struct fpu *fpu)
| ^
arch/x86/kernel/fpu/core.c:466:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
466 | unsigned int get_fpustate_free_space(struct fpu *fpu)
| ^
| static
6 warnings generated.
vim +/set_c86_features_para_invalid +480 arch/x86/kernel/cpu/hygon.c
479
> 480 void set_c86_features_para_invalid(void)
481 {
482 memset((void *)&hygon_c86_data, 0, sizeof(struct hygon_c86_info));
483 }
484
> 485 unsigned int get_nt_block_copy_mini_len(void)
486 {
487 unsigned int mini_len = hygon_c86_data.nt_cpy_mini_len;
488
489 return mini_len;
490 }
491 EXPORT_SYMBOL_GPL(get_nt_block_copy_mini_len);
492
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
From: "Darrick J. Wong" <djwong(a)kernel.org>
stable inclusion
from stable-v6.1.92
commit 4db0e08ef9aceee6947ebdb387439b5600e7564f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBB6IN
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
[ Upstream commit 76e589013fec672c3587d6314f2d1f0aeddc26d9 ]
In the next patch, we're going to prohibit log recovery if the primary
superblock contains an unrecognized rocompat feature bit even on
readonly mounts. This requires removing all the code in the log
mounting process that temporarily disables the readonly state.
Unfortunately, inode inactivation disables itself on readonly mounts.
Clearing the iunlinked lists after log recovery needs inactivation to
run to free the unreferenced inodes, which (AFAICT) is the only reason
why log mounting plays games with the readonly state in the first place.
Therefore, change the inactivation predicates to allow inactivation
during log recovery of a readonly mount.
Fixes: 400cf2265d55 ("[Backport] xfs: fix log recovery when unknown rocompat bits are set")
Signed-off-by: Darrick J. Wong <djwong(a)kernel.org>
Reviewed-by: Dave Chinner <dchinner(a)redhat.com>
Signed-off-by: Leah Rumancik <leah.rumancik(a)gmail.com>
Acked-by: Darrick J. Wong <djwong(a)kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/xfs/xfs_inode.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index f77a27f73bb5..3230cc0ff722 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1841,8 +1841,11 @@ xfs_inode_needs_inactive(
if (VFS_I(ip)->i_mode == 0)
return false;
- /* If this is a read-only mount, don't do this (would generate I/O) */
- if (xfs_is_readonly(mp))
+ /*
+ * If this is a read-only mount, don't do this (would generate I/O)
+ * unless we're in log recovery and cleaning the iunlinked list.
+ */
+ if (xfs_is_readonly(mp) && !xlog_recovery_needed(mp->m_log))
return false;
/* If the log isn't running, push inodes straight to reclaim. */
@@ -1902,8 +1905,11 @@ xfs_inactive(
mp = ip->i_mount;
ASSERT(!xfs_iflags_test(ip, XFS_IRECOVERY));
- /* If this is a read-only mount, don't do this (would generate I/O) */
- if (xfs_is_readonly(mp))
+ /*
+ * If this is a read-only mount, don't do this (would generate I/O)
+ * unless we're in log recovery and cleaning the iunlinked list.
+ */
+ if (xfs_is_readonly(mp) && !xlog_recovery_needed(mp->m_log))
goto out;
/* Metadata inodes require explicit resource cleanup. */
--
2.46.1