- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] bpf: Fix out-of-bounds write in trie_get_next_key()
by Xiaomeng Zhang 25 Nov '24

25 Nov '24

From: Byeonguk Jeong <jungbu2855(a)gmail.com> stable inclusion from stable-v5.10.229 commit 590976f921723d53ac199c01d5b7b73a94875e68 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB379Y CVE: CVE-2024-50262 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21 ] trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8. Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map") Signed-off-by: Byeonguk Jeong <jungbu2855(a)gmail.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)kernel.org> Tested-by: Hou Tao <houtao1(a)huawei.com> Acked-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/Zxx384ZfdlFYnz6J@localhost.localdomain Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/lpm_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c index 3c2d8722d45b..8370b391f1d6 100644 --- a/kernel/bpf/lpm_trie.c +++ b/kernel/bpf/lpm_trie.c @@ -655,7 +655,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) if (!key || key->prefixlen > trie->max_prefixlen) goto find_leftmost; - node_stack = kmalloc_array(trie->max_prefixlen, + node_stack = kmalloc_array(trie->max_prefixlen + 1, sizeof(struct lpm_trie_node *), GFP_ATOMIC | __GFP_NOWARN); if (!node_stack) -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-43817
by Zhang Changzhong 25 Nov '24

25 Nov '24

Felix Fietkau (1): udp: fix receiving fraglist GSO packets Willem de Bruijn (2): net: drop bad gso csum_start and offset in virtio_net_hdr net: tighten bad gso csum offset check in virtio_net_hdr Yan Zhai (1): gso: fix dodgy bit handling for GSO_UDP_L4 include/linux/virtio_net.h | 13 +++++++++++-- net/ipv4/tcp_offload.c | 3 +++ net/ipv4/udp_offload.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 6 deletions(-) -- 2.9.5

2 5

[openeuler:OLK-5.10] BUILD REGRESSION c09bf9815abdd0805b9c0cd61353271d7ecf156f
by kernel test robot 24 Nov '24

24 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c09bf9815abdd0805b9c0cd61353271d7ecf156f !13379 fbdev: sisfb: Fix strbuf array overflow Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411231910.K4RvYzKi-lkp@intel.com drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5776:1: warning: unused label 'out_dbg_init' [-Wunused-label] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:6088:1: warning: unused label 'err_init_guid_fail' [-Wunused-label] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20241123 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- arm64-randconfig-004-20241123 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20241123 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-003-20241123 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-004-20241123 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-006-20241123 | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:unused-label-err_init_guid_fail | `-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:unused-label-out_dbg_init |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-072-20241123 | |-- drivers-gpu-drm-amd-amdgpu-amdgpu_object.o:warning:objtool:amdgpu_bo_release_notify:unreachable-instruction | |-- drivers-gpu-drm-i915-gt-uc-intel_guc_ct.o:warning:objtool:intel_guc_ct_event_handler:unreachable-instruction | |-- fs-buffer.o:warning:objtool:__breadahead_gfp:unreachable-instruction | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-076-20241123 | |-- kernel-sched-core.o:warning:objtool:sched_set_fifo:unreachable-instruction | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-101-20241123 | `-- arch-x86-kvm-mmu-mmu.o:warning:objtool:mmu_set_spte:unreachable-instruction |-- x86_64-randconfig-103-20241123 | |-- security-integrity-ima-ima.h:warning:declaration-of-struct-ima_digest-will-not-be-visible-outside-of-this-function | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-call-expected-have |-- x86_64-randconfig-121-20241123 | |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-assigned-top-got-struct-sched_domain-noderef-__rcu-parent | `-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-top_p-got-struct-sched_domain-noderef-__rcu-parent |-- x86_64-randconfig-122-20241123 | `-- drivers-vfio-pci-vfio_pci_rdwr.c:sparse:sparse:incompatible-types-in-conditional-expression-(different-address-spaces): |-- x86_64-randconfig-123-20241123 | |-- drivers-nvme-target-core.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-callback_head-head-got-struct-callback_head-noderef-__rcu | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-unsigned-char-usertype | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-db_base-got-unsigned-char-usertype | |-- drivers-scsi-huawei-hifc-hifc_cqm_main.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-unsigned-char-usertype-cmd | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-buf_in | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-struct-ffm_record_info-ffm_rd | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-struct-pf_dev_info-dev_info | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-short-usertype-out_size | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-ack | |-- drivers-scsi-huawei-hifc-hifc_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-buf_out | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-gfp-got-unsigned-int-flag | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-cfg_regs_base-got-void-cfg_reg_base | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-db_base-got-void-db_base | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-intr_regs_base-got-void-intr_reg_base | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-assigned-cfg_reg_base-got-void-noderef-__iomem-cfg_reg_base | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-assigned-db_base-got-void-noderef-__iomem-db_base | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-assigned-intr_reg_base-got-void-noderef-__iomem-intr_reg_base | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-scsi-huawei-hifc-hifc_tool.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void | |-- drivers-scsi-huawei-hifc-hifc_tool.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-in_buff | |-- drivers-scsi-huawei-hifc-hifc_tool.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-out_buf | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void | `-- fs-ext4-extents.c:sparse:sparse:Using-plain-integer-as-NULL-pointer `-- x86_64-randconfig-r111-20241123 |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-assigned-top-got-struct-sched_domain-noderef-__rcu-parent |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-sched_domain-top_p-got-struct-sched_domain-noderef-__rcu-parent `-- net-bluetooth-mgmt.c:sparse:sparse:restricted-__le16-degrades-to-integer elapsed time: 721m configs tested: 36 configs skipped: 136 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241123 clang-20 arm64 randconfig-002-20241123 gcc-14.2.0 arm64 randconfig-003-20241123 gcc-14.2.0 arm64 randconfig-004-20241123 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241123 gcc-12 x86_64 buildonly-randconfig-002-20241123 gcc-12 x86_64 buildonly-randconfig-003-20241123 gcc-11 x86_64 buildonly-randconfig-004-20241123 gcc-12 x86_64 buildonly-randconfig-005-20241123 gcc-12 x86_64 buildonly-randconfig-006-20241123 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241123 clang-19 x86_64 randconfig-002-20241123 gcc-12 x86_64 randconfig-003-20241123 clang-19 x86_64 randconfig-004-20241123 clang-19 x86_64 randconfig-005-20241123 gcc-12 x86_64 randconfig-006-20241123 clang-19 x86_64 randconfig-011-20241123 gcc-12 x86_64 randconfig-012-20241123 clang-19 x86_64 randconfig-013-20241123 gcc-12 x86_64 randconfig-014-20241123 clang-19 x86_64 randconfig-015-20241123 clang-19 x86_64 randconfig-016-20241123 gcc-12 x86_64 randconfig-071-20241123 clang-19 x86_64 randconfig-072-20241123 clang-19 x86_64 randconfig-073-20241123 gcc-12 x86_64 randconfig-074-20241123 clang-19 x86_64 randconfig-075-20241123 gcc-11 x86_64 randconfig-076-20241123 clang-19 x86_64 rhel-9.4 gcc-12 x86_64 rhel-9.4-func gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2469/2469] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5776:1: warning: unused label 'out_dbg_init'
by kernel test robot 23 Nov '24

23 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c09bf9815abdd0805b9c0cd61353271d7ecf156f commit: b0c148879a02ad602d4526521d88b0a274aabe8d [2469/2469] UNIC: The driver loading process is terminated when the guid fails to be obtained. config: x86_64-buildonly-randconfig-006-20241123 (https://download.01.org/0day-ci/archive/20241123/202411231910.K4RvYzKi-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241123/202411231910.K4RvYzKi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411231910.K4RvYzKi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:4: In file included from include/linux/dma-mapping.h:10: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:1579: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5776:1: warning: unused label 'out_dbg_init' [-Wunused-label] 5776 | out_dbg_init: | ^~~~~~~~~~~~~ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:6088:1: warning: unused label 'err_init_guid_fail' [-Wunused-label] 6088 | err_init_guid_fail: | ^~~~~~~~~~~~~~~~~~~ 3 warnings generated. vim +/out_dbg_init +5776 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 5757 5758 hns3_state_init(handle); 5759 5760 if (test_bit(HNAE3_DEV_SUPPORT_QB_B, ae_dev->caps)) 5761 set_bit(HNAE3_PFLAG_FD_QB_ENABLE, &handle->supported_pflags); 5762 5763 ret = register_netdev(netdev); 5764 if (ret) { 5765 dev_err(priv->dev, "probe register netdev fail!\n"); 5766 goto out_reg_netdev_fail; 5767 } 5768 5769 if (netif_msg_drv(handle)) 5770 hns3_info_show(priv); 5771 5772 return ret; 5773 5774 out_reg_netdev_fail: 5775 hns3_state_uninit(handle); > 5776 out_dbg_init: 5777 hns3_dbg_uninit(handle); 5778 hns3_client_stop(handle); 5779 out_client_start: 5780 hns3_free_rx_cpu_rmap(netdev); 5781 hns3_nic_uninit_irq(priv); 5782 out_init_irq_fail: 5783 hns3_uninit_phy(netdev); 5784 out_init_phy: 5785 hns3_uninit_all_ring(priv); 5786 out_init_ring: 5787 hns3_nic_uninit_vector_data(priv); 5788 out_init_vector_data: 5789 hns3_nic_dealloc_vector_data(priv); 5790 out_alloc_vector_data: 5791 priv->ring = NULL; 5792 out_get_ring_cfg: 5793 priv->ae_handle = NULL; 5794 free_netdev(netdev); 5795 return ret; 5796 } 5797 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
by Baokun Li 23 Nov '24

23 Nov '24

From: Andrew Kanner <andrew.kanner(a)gmail.com> stable inclusion from stable-v5.10.230 commit 6a7e6dcf90fe7721d0863067b6ca9a9442134692 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AW2 CVE: CVE-2024-50265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream. Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.") Signed-off-by: Andrew Kanner <andrew.kanner(a)gmail.com> Reported-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ Tested-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ocfs2/xattr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 00ede36aeec9..051d91e230c4 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -2042,8 +2042,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, rc = 0; ocfs2_xa_cleanup_value_truncate(loc, "removing", orig_clusters); - if (rc) - goto out; + goto out; } } -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
by Baokun Li 23 Nov '24

23 Nov '24

From: Andrew Kanner <andrew.kanner(a)gmail.com> stable inclusion from stable-v5.10.230 commit 6a7e6dcf90fe7721d0863067b6ca9a9442134692 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AW2 CVE: CVE-2024-50265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream. Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.") Signed-off-by: Andrew Kanner <andrew.kanner(a)gmail.com> Reported-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ Tested-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ocfs2/xattr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 42368577786e..5b56e10e510b 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -2042,8 +2042,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, rc = 0; ocfs2_xa_cleanup_value_truncate(loc, "removing", orig_clusters); - if (rc) - goto out; + goto out; } } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
by Baokun Li 23 Nov '24

23 Nov '24

From: Andrew Kanner <andrew.kanner(a)gmail.com> stable inclusion from stable-v4.19.324 commit 38cbf13b2e7a31362babe411f7c2c3c52cd2734b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AW2 CVE: CVE-2024-50265 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream. Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.") Signed-off-by: Andrew Kanner <andrew.kanner(a)gmail.com> Reported-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ Tested-by: syzbot+386ce9e60fa1b18aac5b(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ocfs2/xattr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index c146e12a8601..410acc20c7c4 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -2041,8 +2041,7 @@ static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc, rc = 0; ocfs2_xa_cleanup_value_truncate(loc, "removing", orig_clusters); - if (rc) - goto out; + goto out; } } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
by Baokun Li 23 Nov '24

23 Nov '24

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v5.10.230 commit 485d9232112b17f389b29497ff41b97b3189546b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQC CVE: CVE-2024-53052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit 1d60d74e852647255bd8e76f5a22dc42531e4389 upstream. When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write is in-flight. The freeze side will grab that rwsem for writing, excluding any new writers from happening and waiting for existing writes to finish. But io_uring unconditionally uses kiocb_start_write(), which will block if someone is currently attempting to freeze the mount point. This causes a deadlock where freeze is waiting for previous writes to complete, but the previous writes cannot complete, as the task that is supposed to complete them is blocked waiting on starting a new write. This results in the following stuck trace showing that dependency with the write blocked starting a new write: task:fio state:D stack:0 pid:886 tgid:886 ppid:876 Call trace: __switch_to+0x1d8/0x348 __schedule+0x8e8/0x2248 schedule+0x110/0x3f0 percpu_rwsem_wait+0x1e8/0x3f8 __percpu_down_read+0xe8/0x500 io_write+0xbb8/0xff8 io_issue_sqe+0x10c/0x1020 io_submit_sqes+0x614/0x2110 __arm64_sys_io_uring_enter+0x524/0x1038 invoke_syscall+0x74/0x268 el0_svc_common.constprop.0+0x160/0x238 do_el0_svc+0x44/0x60 el0_svc+0x44/0xb0 el0t_64_sync_handler+0x118/0x128 el0t_64_sync+0x168/0x170 INFO: task fsfreeze:7364 blocked for more than 15 seconds. Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963 with the attempting freezer stuck trying to grab the rwsem: task:fsfreeze state:D stack:0 pid:7364 tgid:7364 ppid:995 Call trace: __switch_to+0x1d8/0x348 __schedule+0x8e8/0x2248 schedule+0x110/0x3f0 percpu_down_write+0x2b0/0x680 freeze_super+0x248/0x8a8 do_vfs_ioctl+0x149c/0x1b18 __arm64_sys_ioctl+0xd0/0x1a0 invoke_syscall+0x74/0x268 el0_svc_common.constprop.0+0x160/0x238 do_el0_svc+0x44/0x60 el0_svc+0x44/0xb0 el0t_64_sync_handler+0x118/0x128 el0t_64_sync+0x168/0x170 Fix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a blocking grab of the super block rwsem if it isn't set. For normal issue where IOCB_NOWAIT would always be set, this returns -EAGAIN which will have io_uring core issue a blocking attempt of the write. That will in turn also get completions run, ensuring forward progress. Since freezing requires CAP_SYS_ADMIN in the first place, this isn't something that can be triggered by a regular user. Cc: stable(a)vger.kernel.org # 5.10+ Reported-by: Peter Mann <peter.mann(a)sh.cz> Link: https://lore.kernel.org/io-uring/38c94aec-81c9-4f62-b44e-1d87f5597644@sh.cz Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/io_uring.c [Context differences.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/io_uring.c | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 411b7491f3f5..96255b816d71 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3174,6 +3174,27 @@ static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe, return io_rw_prep_async(req, WRITE, force_nonblock); } +static bool io_kiocb_start_write(struct io_kiocb *req, struct kiocb *kiocb) +{ + struct inode *inode; + bool ret; + + if (!(req->flags & REQ_F_ISREG)) + return true; + + inode = file_inode(kiocb->ki_filp); + if (!(kiocb->ki_flags & IOCB_NOWAIT)) { + __sb_start_write(inode->i_sb, SB_FREEZE_WRITE, true); + __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE); + return true; + } + + ret = sb_start_write_trylock(inode->i_sb); + if (ret) + __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE); + return ret; +} + static int io_write(struct io_kiocb *req, bool force_nonblock, struct io_comp_state *cs) { @@ -3209,19 +3230,8 @@ static int io_write(struct io_kiocb *req, bool force_nonblock, unsigned long nr_segs = iter.nr_segs; ssize_t ret2; - /* - * Open-code file_start_write here to grab freeze protection, - * which will be released by another thread in - * io_complete_rw(). Fool lockdep by telling it the lock got - * released so that it doesn't complain about the held lock when - * we return to userspace. - */ - if (req->flags & REQ_F_ISREG) { - __sb_start_write(file_inode(req->file)->i_sb, - SB_FREEZE_WRITE, true); - __sb_writers_release(file_inode(req->file)->i_sb, - SB_FREEZE_WRITE); - } + if (unlikely(!io_kiocb_start_write(req, kiocb))) + goto copy_iov; kiocb->ki_flags |= IOCB_WRITE; if (req->file->f_op->write_iter) -- 2.46.1

2 1

[PATCH OLK-5.10 0/4] io_uring: fix CVE-2024-53052
by Baokun Li 23 Nov '24

23 Nov '24

Amir Goldstein (3): io_uring: rename kiocb_end_write() local helper fs: create kiocb_{start,end}_write() helpers io_uring: use kiocb_{start,end}_write() helpers Jens Axboe (1): io_uring/rw: fix missing NOWAIT check for O_DIRECT start write include/linux/fs.h | 35 +++++++++++++++++++++++++++++++ io_uring/io_uring.c | 50 ++++++++++++++++++++++++--------------------- 2 files changed, 62 insertions(+), 23 deletions(-) -- 2.46.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] io_uring: fix CVE-2024-53052
by Baokun Li 23 Nov '24

23 Nov '24

Amir Goldstein (3): io_uring: rename kiocb_end_write() local helper fs: create kiocb_{start,end}_write() helpers io_uring: use kiocb_{start,end}_write() helpers Jens Axboe (1): io_uring/rw: fix missing NOWAIT check for O_DIRECT start write include/linux/fs.h | 35 +++++++++++++++++++++++++++++++ io_uring/io_uring.c | 50 ++++++++++++++++++++++++--------------------- 2 files changed, 62 insertions(+), 23 deletions(-) -- 2.46.1

2 5