- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19 00/18] backport linux-4.19.200
by Yang Yingliang 05 Aug '21

05 Aug '21

Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Greg Kroah-Hartman (2): selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c Linux 4.19.200 Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Jens Axboe (1): net: split out functions related to registering inflight socket files Maxim Levitsky (1): KVM: x86: determine if an exception has an error code only when injecting it. Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Ruslan Babayev (1): iio: dac: ds4422/ds4424 drop of_node check Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join() Makefile | 2 +- arch/arm/boot/dts/versatile-ab.dts | 5 +- arch/arm/boot/dts/versatile-pb.dts | 2 +- arch/x86/kvm/x86.c | 13 +- drivers/firmware/arm_scmi/driver.c | 12 +- drivers/iio/dac/ds4424.c | 6 - fs/cifs/smb2ops.c | 4 +- fs/hfs/bfind.c | 14 ++- fs/hfs/bnode.c | 25 +++- fs/hfs/btree.h | 7 ++ fs/hfs/super.c | 10 +- include/net/af_unix.h | 1 + include/net/busy_poll.h | 2 +- include/net/sctp/constants.h | 4 +- kernel/workqueue.c | 20 +-- net/802/garp.c | 14 +++ net/802/mrp.c | 14 +++ net/Makefile | 2 +- net/core/sock.c | 2 +- net/sctp/protocol.c | 3 +- net/unix/Kconfig | 5 + net/unix/Makefile | 2 + net/unix/af_unix.c | 102 +++++++--------- net/unix/garbage.c | 68 +---------- net/unix/scm.c | 148 +++++++++++++++++++++++ net/unix/scm.h | 10 ++ tools/testing/selftests/vm/userfaultfd.c | 2 +- 27 files changed, 328 insertions(+), 171 deletions(-) create mode 100644 net/unix/scm.c create mode 100644 net/unix/scm.h -- 2.25.1

1 18

[PATCH openEuler-1.0-LTS 1/2] Input: joydev - prevent potential read overflow in ioctl
by Yang Yingliang 04 Aug '21

04 Aug '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from linux-4.19.178 commit 88438fdeeffe11dcb05c2dd0ddd22cb6e3f024b4 CVE: CVE-2021-3612 -------------------------------- commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream. The problem here is that "len" might be less than "joydev->nabs" so the loops which verfy abspam[i] and keypam[] might read beyond the buffer. Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda [dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP] Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/input/joydev.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c index 4c1e427dfabb9..7ef6e1c165e35 100644 --- a/drivers/input/joydev.c +++ b/drivers/input/joydev.c @@ -460,7 +460,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev, if (IS_ERR(abspam)) return PTR_ERR(abspam); - for (i = 0; i < joydev->nabs; i++) { + for (i = 0; i < len && i < joydev->nabs; i++) { if (abspam[i] > ABS_MAX) { retval = -EINVAL; goto out; @@ -484,6 +484,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, int i; int retval = 0; + if (len % sizeof(*keypam)) + return -EINVAL; + len = min(len, sizeof(joydev->keypam)); /* Validate the map. */ @@ -491,7 +494,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, if (IS_ERR(keypam)) return PTR_ERR(keypam); - for (i = 0; i < joydev->nkey; i++) { + for (i = 0; i < (len / 2) && i < joydev->nkey; i++) { if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) { retval = -EINVAL; goto out; -- 2.25.1

1 1

[PATCH kernel-4.19 1/5] Revert "modpost: explain why we can't use strsep"
by Yang Yingliang 04 Aug '21

04 Aug '21

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46847 CVE: NA ----------------------------------------------- This reverts commit bd34c7e237442f10576363ea3515da4aca39baf1. This series of patches could raise an issue on module built. When we build a module that contains .cpp source file, we could only build the corresponding object file by calling gcc emplicitly instead of using the kbuild framework supplied by kernel. As a consequence, the .cmd file that records the build command for the object file goes missing. This patches series treat that missing .cmd file as a fatal error and break the module build. Although linking a object file supplied by user into a module is informal, the user has already done that and we'd better not break it for compatibility. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- scripts/mod/modpost.c | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index a6f25b67b1cf1..ed5e38df9a7dc 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -166,7 +166,6 @@ char *get_line(char **stringp) if (!orig || *orig == '\0') return NULL; - /* don't use strsep here, it is not available everywhere */ next = strchr(orig, '\n'); if (next) *next++ = '\0'; -- 2.25.1

1 4

[PATCH kernel-4.19] mm/slab: add naive detection of double free
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v5.9-rc1 commit dabc3e291d56e3125113101bc6d53d1a1738294d category: bugfix bugzilla: 41100 CVE: NA ------------------------------------------------- Similar to commit ce6fa91b9363 ("mm/slub.c: add a naive detection of double free or corruption"), add a very cheap double-free check for SLAB under CONFIG_SLAB_FREELIST_HARDENED. With this added, the "SLAB_FREE_DOUBLE" LKDTM test passes under SLAB: lkdtm: Performing direct entry SLAB_FREE_DOUBLE lkdtm: Attempting double slab free ... ------------[ cut here ]------------ WARNING: CPU: 2 PID: 2193 at mm/slab.c:757 ___cache _free+0x325/0x390 [keescook(a)chromium.org: fix misplaced __free_one()] Link: http://lkml.kernel.org/r/202006261306.0D82A2B@keescook Link: https://lore.kernel.org/lkml/7ff248c7-d447-340c-a8e2-8c02972aca70@infradead… Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Randy Dunlap <rdunlap(a)infradead.org> [build tested] Cc: Roman Gushchin <guro(a)fb.com> Cc: Christoph Lameter <cl(a)linux.com> Cc: Alexander Popov <alex.popov(a)linux.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Vinayak Menon <vinmenon(a)codeaurora.org> Cc: Matthew Garrett <mjg59(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Vijayanand Jitta <vjitta(a)codeaurora.org> Link: http://lkml.kernel.org/r/20200625215548.389774-3-keescook@chromium.org Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/slab.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index a818297ef5241..922bfeb94c803 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -630,6 +630,16 @@ static int transfer_objects(struct array_cache *to, return nr; } +/* &alien->lock must be held by alien callers. */ +static __always_inline void __free_one(struct array_cache *ac, void *objp) +{ + /* Avoid trivial double-free. */ + if (IS_ENABLED(CONFIG_SLAB_FREELIST_HARDENED) && + WARN_ON_ONCE(ac->avail > 0 && ac->entry[ac->avail - 1] == objp)) + return; + ac->entry[ac->avail++] = objp; +} + #ifndef CONFIG_NUMA #define drain_alien_cache(cachep, alien) do { } while (0) @@ -810,7 +820,7 @@ static int __cache_free_alien(struct kmem_cache *cachep, void *objp, STATS_INC_ACOVERFLOW(cachep); __drain_alien_cache(cachep, ac, page_node, &list); } - ac->entry[ac->avail++] = objp; + __free_one(ac, objp); spin_unlock(&alien->lock); slabs_destroy(cachep, &list); } else { @@ -3532,7 +3542,7 @@ void ___cache_free(struct kmem_cache *cachep, void *objp, } } - ac->entry[ac->avail++] = objp; + __free_one(ac, objp); } /** -- 2.25.1

1 0

[PATCH kernel-4.19 1/4] iommu/amd: Prevent NULL pointer dereference
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v5.10-rc1 commit 23357b61f8062a8a8c9c84c0252056cd6d849ec8 category: bugfix bugzilla: 43219 CVE: NA ------------------------------------------------ Dereferencing irq_data before checking it for NULL is suboptimal. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Joerg Roedel <jroedel(a)suse.de> Conflicts: drivers/iommu/amd/iommu.c Signed-off-by: Chen Huang <chenhuang5(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/amd_iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index 8148f240aac31..d7a288dd15667 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -4254,8 +4254,8 @@ static int irq_remapping_alloc(struct irq_domain *domain, unsigned int virq, for (i = 0; i < nr_irqs; i++) { irq_data = irq_domain_get_irq_data(domain, virq + i); - cfg = irqd_cfg(irq_data); - if (!irq_data || !cfg) { + cfg = irq_data ? irqd_cfg(irq_data) : NULL; + if (!cfg) { ret = -EINVAL; goto out_free_data; } -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] cpuidle: fix return type err in haltpoll_switch_governor
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Jiajun Chen <chenjiajun8(a)huawei.com> euleros inclusion category: bugfix bugzilla: NA CVE: NA --------------------------- while CONFIG_CPU_IDLE is disabled, the haltpoll_switch_governor function should not return int type result,which will cause build err. Fixes: 97c227885e0a ("cpuidle: fix container_of err in cpuidle_device and cpuidle_driver") Signed-off-by: Jiajun Chen <chenjiajun8(a)huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/cpuidle.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h index e365f5dfe6e7d..9dd5a6b27b212 100644 --- a/include/linux/cpuidle.h +++ b/include/linux/cpuidle.h @@ -200,8 +200,7 @@ static inline u64 cpuidle_haltpoll_time(struct cpuidle_driver *drv, {return 0; } static inline int cpuidle_register_driver(struct cpuidle_driver *drv) {return -ENODEV; } -static inline void haltpoll_switch_governor(struct cpuidle_driver *drv) -{return -ENODEV; } +static inline void haltpoll_switch_governor(struct cpuidle_driver *drv) { } static inline struct cpuidle_driver *cpuidle_get_driver(void) {return NULL; } static inline struct cpuidle_driver *cpuidle_driver_ref(void) {return NULL; } static inline void cpuidle_driver_unref(void) {} -- 2.25.1

1 0

[openEuler-21.09 01/44] ACPI: APEI: fix synchronous external aborts in user-mode
by Zheng Zengkai 03 Aug '21

03 Aug '21

From: Xiaofei Tan <tanxiaofei(a)huawei.com> mainline inclusion from mainline-v5.14-rc1 commit ccb5ecdc2ddeaff744ee075b54cdff8a689e8fa7 category: bugfix bugzilla: 168583 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- Before commit 8fcc4ae6faf8 ("arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work"), do_sea() would unconditionally signal the affected task from the arch code. Since that change, the GHES driver sends the signals. This exposes a problem as errors the GHES driver doesn't understand or doesn't handle effectively are silently ignored. It will cause the errors get taken again, and circulate endlessly. User-space task get stuck in this loop. Existing firmware on Kunpeng9xx systems reports cache errors with the 'ARM Processor Error' CPER records. Do memory failure handling for ARM Processor Error Section just like for Memory Error Section. Fixes: 8fcc4ae6faf8 ("arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work") Signed-off-by: Xiaofei Tan <tanxiaofei(a)huawei.com> Reviewed-by: James Morse <james.morse(a)arm.com> [ rjw: Subject edit ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Yunsheng Lin <linyunsheng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/acpi/apei/ghes.c | 81 +++++++++++++++++++++++++++++++--------- 1 file changed, 64 insertions(+), 17 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index fce7ade2aba9..0c8330ed1ffd 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -441,28 +441,35 @@ static void ghes_kick_task_work(struct callback_head *head) gen_pool_free(ghes_estatus_pool, (unsigned long)estatus_node, node_len); } -static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, - int sev) +static bool ghes_do_memory_failure(u64 physical_addr, int flags) { unsigned long pfn; - int flags = -1; - int sec_sev = ghes_severity(gdata->error_severity); - struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata); if (!IS_ENABLED(CONFIG_ACPI_APEI_MEMORY_FAILURE)) return false; - if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) - return false; - - pfn = mem_err->physical_addr >> PAGE_SHIFT; + pfn = PHYS_PFN(physical_addr); if (!pfn_valid(pfn)) { pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid address in generic error data: %#llx\n", - mem_err->physical_addr); + physical_addr); return false; } + memory_failure_queue(pfn, flags); + return true; +} + +static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, + int sev) +{ + int flags = -1; + int sec_sev = ghes_severity(gdata->error_severity); + struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata); + + if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) + return false; + /* iff following two events can be handled properly by now */ if (sec_sev == GHES_SEV_CORRECTED && (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED)) @@ -470,14 +477,56 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, if (sev == GHES_SEV_RECOVERABLE && sec_sev == GHES_SEV_RECOVERABLE) flags = 0; - if (flags != -1) { - memory_failure_queue(pfn, flags); - return true; - } + if (flags != -1) + return ghes_do_memory_failure(mem_err->physical_addr, flags); return false; } +static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int sev) +{ + struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); + bool queued = false; + int sec_sev, i; + char *p; + + log_arm_hw_error(err); + + sec_sev = ghes_severity(gdata->error_severity); + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) + return false; + + p = (char *)(err + 1); + for (i = 0; i < err->err_info_num; i++) { + struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; + bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); + bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + const char *error_type = "unknown error"; + + /* + * The field (err_info->error_info & BIT(26)) is fixed to set to + * 1 in some old firmware of HiSilicon Kunpeng920. We assume that + * firmware won't mix corrected errors in an uncorrected section, + * and don't filter out 'corrected' error here. + */ + if (is_cache && has_pa) { + queued = ghes_do_memory_failure(err_info->physical_fault_addr, 0); + p += err_info->length; + continue; + } + + if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs)) + error_type = cper_proc_error_type_strs[err_info->type]; + + pr_warn_ratelimited(FW_WARN GHES_PFX + "Unhandled processor error type: %s\n", + error_type); + p += err_info->length; + } + + return queued; +} + /* * PCIe AER errors need to be sent to the AER driver for reporting and * recovery. The GHES severities map to the following AER severities and @@ -605,9 +654,7 @@ static bool ghes_do_proc(struct ghes *ghes, ghes_handle_aer(gdata); } else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) { - struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); - - log_arm_hw_error(err); + queued = ghes_handle_arm_hw_error(gdata, sev); } else { void *err = acpi_hest_get_payload(gdata); -- 2.20.1

1 43

【Meeting Notice】openEuler kernel 技术分享第九期 & 双周例会 Time: 2021-08-06 14:00-18:00
by Meeting Book 03 Aug '21

03 Aug '21

1 0

[PATCH openEuler-1.0-LTS 0/2] prefetch bugfix
by Cheng Jian 02 Aug '21

02 Aug '21

prefetch bugfix Li Ruilin (2): bcache: do not collect data insert info created by write_moving bcache: always record start time of a sample drivers/md/bcache/request.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) -- 2.25.1

1 2

[PATCH kernel-4.19 01/10] tcp_comp: add Kconfig for tcp payload compression
by Yang Yingliang 02 Aug '21

02 Aug '21

From: Wei Yongjun <weiyongjun1(a)huawei.com> hulk inclusion category: feature bugzilla: NA CVE: NA ------------------------------------------------- Add config item CONFIG_TCP_COMP for tcp payload compression. This allows payload compression handling of the TCP protocol to be done in-kernel. This patch only adds the CONFIG_TCP_COMP config, tcp compression capability is implemented later. Signed-off-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/ipv4/Kconfig | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig index 2e12f848203a4..883a638648e1f 100644 --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig @@ -754,3 +754,11 @@ config TCP_MD5SIG on the Internet. If unsure, say N. + +config TCP_COMP + bool "TCP: Transport Layer Compression support" + ---help--- + Enable kernel payload compression support for TCP protocol. This allows + payload compression handling of the TCP protocol to be done in-kernel. + + If unsure, say Y. -- 2.25.1

1 9