- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] net: fix memory leak in tcp_conn_request()
by Wang Liang 07 Feb '25

07 Feb '25

stable inclusion from stable-v6.6.70 commit 2af69905180b3fea12f9c1db374b153a06977021 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2D CVE: CVE-2024-57841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f4aa4aa28142d53f8b06585c478476cfe325cfc ] If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req. Here is the kmemleak stack: unreferenced object 0xffff8881198631c0 (size 240): comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s) hex dump (first 32 bytes): 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................ 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U.............. backtrace: [<ffffffffb93e8d4c>] kmem_cache_alloc+0x60c/0xa80 [<ffffffffba11b4c5>] dst_alloc+0x55/0x250 [<ffffffffba227bf6>] rt_dst_alloc+0x46/0x1d0 [<ffffffffba23050a>] __mkroute_output+0x29a/0xa50 [<ffffffffba23456b>] ip_route_output_key_hash+0x10b/0x240 [<ffffffffba2346bd>] ip_route_output_flow+0x1d/0x90 [<ffffffffba254855>] inet_csk_route_req+0x2c5/0x500 [<ffffffffba26b331>] tcp_conn_request+0x691/0x12c0 [<ffffffffba27bd08>] tcp_rcv_state_process+0x3c8/0x11b0 [<ffffffffba2965c6>] tcp_v4_do_rcv+0x156/0x3b0 [<ffffffffba299c98>] tcp_v4_rcv+0x1cf8/0x1d80 [<ffffffffba239656>] ip_protocol_deliver_rcu+0xf6/0x360 [<ffffffffba2399a6>] ip_local_deliver_finish+0xe6/0x1e0 [<ffffffffba239b8e>] ip_local_deliver+0xee/0x360 [<ffffffffba239ead>] ip_rcv+0xad/0x2f0 [<ffffffffba110943>] __netif_receive_skb_one_core+0x123/0x140 Call dst_release() to free the dst memory when inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request(). Fixes: ff46e3b44219 ("Fix race for duplicate reqsk on identical SYN") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Link: https://patch.msgid.link/20241219072859.3783576-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/tcp_input.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 69406fbc13bd..7418f64dd851 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -7225,6 +7225,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, req->timeout))) { reqsk_free(req); + dst_release(dst); return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] net/smc: check smcd_v2_ext_offset when receiving proposal msg
by Wang Liang 07 Feb '25

07 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 935caf324b445fe73d7708fae6f7176fb243f357 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC6V CVE: CVE-2024-47408 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9ab332deb671d8f7e66d82a2ff2b3f715bc3a4ad ] When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be fully trusted. Once the value of smcd_v2_ext_offset exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the value of smcd_v2_ext_offset before using it. Fixes: 5c21c4ccafe8 ("net/smc: determine accepted ISM devices") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 2 ++ net/smc/smc_clc.h | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 6881fd03ef25..d5c686ea380b 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2153,6 +2153,8 @@ static void smc_find_ism_v2_device_serv(struct smc_sock *new_smc, pclc_smcd = smc_get_clc_msg_smcd(pclc); smc_v2_ext = smc_get_clc_v2_ext(pclc); smcd_v2_ext = smc_get_clc_smcd_v2_ext(smc_v2_ext); + if (!pclc_smcd || !smc_v2_ext || !smcd_v2_ext) + goto not_found; mutex_lock(&smcd_dev_list.mutex); if (pclc_smcd->ism.chid) { diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h index 58777b6a0dfe..eab3544a401c 100644 --- a/net/smc/smc_clc.h +++ b/net/smc/smc_clc.h @@ -380,9 +380,15 @@ smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop) static inline struct smc_clc_smcd_v2_extension * smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext) { + u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) - + offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) - + offsetof(struct smc_clc_v2_extension, hdr) - + offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset); + if (!prop_v2ext) return NULL; - if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset)) + if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) || + ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset) return NULL; return (struct smc_clc_smcd_v2_extension *) -- 2.34.1

2 1

[PATCH OLK-6.6] net/smc: check return value of sock_recvmsg when draining clc data
by Wang Liang 07 Feb '25

07 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 7a6927814b4256d603e202ae7c5e38db3b338896 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCNG CVE: CVE-2024-57791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c5b8ee5022a19464783058dc6042e8eefa34e8cd ] When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and the value should not be fully trusted as it is from the network. Once the value of length exceeds the value of buflen in function smc_clc_wait_msg it may run into deadloop when trying to drain the remaining data exceeding buflen. This patch checks the return value of sock_recvmsg when draining data in case of deadloop in draining. Fixes: fb4f79264c0f ("net/smc: tolerate future SMCD versions") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/smc_clc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index d96ad04e7dcf..e3c027502f2e 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -764,6 +764,11 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, SMC_CLC_RECV_BUF_LEN : datlen; iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, recvlen); len = sock_recvmsg(smc->clcsock, &msg, krflags); + if (len < recvlen) { + smc->sk.sk_err = EPROTO; + reason_code = -EPROTO; + goto out; + } datlen -= len; } if (clcm->type == SMC_CLC_DECLINE) { -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 0dfa6b9ea8d763e5e5134ce053f30ad87a65095a
by kernel test robot 07 Feb '25

07 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0dfa6b9ea8d763e5e5134ce053f30ad87a65095a !15010 nvme-rdma: unquiesce admin_q before destroy it Error/Warning (recently discovered and may have been fixed): drivers/gpu/drm/vc4/vc4_crtc.o: warning: objtool: vc4_crtc_disable()+0x1a5: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-004-20250206 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | `-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets |-- x86_64-buildonly-randconfig-001-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250205 | `-- drivers-gpu-drm-vc4-vc4_crtc.o:warning:objtool:vc4_crtc_disable:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-003-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250206 | |-- block-blk-settings.o:warning:objtool:blk_queue_set_zoned:unreachable-instruction | |-- drivers-base-regmap-regmap-debugfs.o:warning:objtool:regmap_reg_ranges_read_file:unreachable-instruction | |-- drivers-char-xillybus-xillybus_core.o:warning:objtool:xillybus_read:unreachable-instruction | |-- drivers-counter-counter.o:warning:objtool:devm_counter_match:unreachable-instruction | |-- drivers-media-dvb-core-dvb_ringbuffer.o:warning:objtool:dvb_ringbuffer_read_user:unreachable-instruction | |-- drivers-misc-lkdtm-usercopy.o:warning:objtool:do_usercopy_heap_size:unreachable-instruction | |-- drivers-mtd-ubi-cdev.o:warning:objtool:vol_cdev_read:unreachable-instruction | |-- drivers-mtd-ubi-upd.o:warning:objtool:ubi_more_update_data:unreachable-instruction | |-- drivers-thunderbolt-ctl.o:warning:objtool:tb_ctl_tx:unreachable-instruction | |-- drivers-thunderbolt-switch.o:warning:objtool:tb_wait_for_port:unreachable-instruction | |-- drivers-thunderbolt-tunnel.o:warning:objtool:tb_dp_xchg_caps:unreachable-instruction | |-- fs-libfs.o:warning:objtool:simple_read_from_buffer:unreachable-instruction | |-- fs-pstore-ram_core.o:warning:objtool:persistent_ram_update_user:unreachable-instruction | |-- kernel-dma-map_benchmark.o:warning:objtool:map_benchmark_thread:unreachable-instruction | |-- kernel-sched-membarrier.o:warning:objtool:membarrier_register_private_expedited:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-platform-x86-toshiba_acpi.c:warning:fan_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:keys_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:lcd_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:video_proc_ops-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page `-- x86_64-defconfig |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page elapsed time: 723m configs tested: 15 configs skipped: 96 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250206 clang-21 arm64 randconfig-002-20250206 clang-21 arm64 randconfig-003-20250206 clang-15 arm64 randconfig-004-20250206 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250206 clang-19 x86_64 buildonly-randconfig-002-20250206 clang-19 x86_64 buildonly-randconfig-003-20250206 clang-19 x86_64 buildonly-randconfig-004-20250206 clang-19 x86_64 buildonly-randconfig-005-20250206 clang-19 x86_64 buildonly-randconfig-006-20250206 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinmux: Use sequential access to access desc->pinmux data
by Zhang Kunbo 06 Feb '25

06 Feb '25

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v6.6.66 commit 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIFR8 CVE: CVE-2024-47141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ] When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } } Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/pinctrl/pinmux.c [ Scope-based resource management is not merged yet (54da6a092431), so we lock the data-race region by hand ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/pinctrl/core.c | 3 +++ drivers/pinctrl/core.h | 1 + drivers/pinctrl/pinmux.c | 25 +++++++++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index b7a6bab4ac01..118c4975c777 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev, /* Set owner */ pindesc->pctldev = pctldev; +#ifdef CONFIG_PINMUX + mutex_init(&pindesc->mux_lock); +#endif /* Copy basic pin info */ if (pin->name) { diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h index 840103c40c14..f5e4ca19c17b 100644 --- a/drivers/pinctrl/core.h +++ b/drivers/pinctrl/core.h @@ -167,6 +167,7 @@ struct pin_desc { const char *mux_owner; const struct pinctrl_setting_mux *mux_setting; const char *gpio_owner; + struct mutex mux_lock; #endif }; diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index bab888fe3f8e..bfab925dbf04 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -27,6 +27,7 @@ #include <linux/pinctrl/pinmux.h> #include "core.h" #include "pinmux.h" +#include <linux/mutex.h> int pinmux_check_ops(struct pinctrl_dev *pctldev) { @@ -89,9 +90,11 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) if (!desc || !ops) return true; + mutex_lock(&desc->mux_lock); if (ops->strict && desc->mux_usecount) return false; + mutex_unlock(&desc->mux_lock); return !(ops->strict && !!desc->gpio_owner); } @@ -123,6 +126,7 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n", pin, desc->name, owner); + mutex_lock(&desc->mux_lock); if ((!gpio_range || ops->strict) && desc->mux_usecount && strcmp(desc->mux_owner, owner)) { dev_err(pctldev->dev, @@ -147,6 +151,7 @@ static int pin_request(struct pinctrl_dev *pctldev, desc->mux_owner = owner; } + mutex_unlock(&desc->mux_lock); /* Let each pin increase references to this module */ if (!try_module_get(pctldev->owner)) { @@ -176,6 +181,7 @@ static int pin_request(struct pinctrl_dev *pctldev, out_free_pin: if (status) { + mutex_lock(&desc->mux_lock); if (gpio_range) { desc->gpio_owner = NULL; } else { @@ -183,6 +189,7 @@ static int pin_request(struct pinctrl_dev *pctldev, if (!desc->mux_usecount) desc->mux_owner = NULL; } + mutex_unlock(&desc->mux_lock); } out: if (status) @@ -237,6 +244,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, else if (ops->free) ops->free(pctldev, pin); + mutex_lock(&desc->mux_lock); if (gpio_range) { owner = desc->gpio_owner; desc->gpio_owner = NULL; @@ -245,6 +253,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, desc->mux_owner = NULL; desc->mux_setting = NULL; } + mutex_unlock(&desc->mux_lock); module_put(pctldev->owner); @@ -457,7 +466,9 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } + mutex_lock(&desc->mux_lock); desc->mux_setting = &(setting->data.mux); + mutex_unlock(&desc->mux_lock); } ret = ops->set_mux(pctldev, setting->data.mux.func, @@ -471,8 +482,11 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) err_set_mux: for (i = 0; i < num_pins; i++) { desc = pin_desc_get(pctldev, pins[i]); - if (desc) + if (desc) { + mutex_lock(&desc->mux_lock); desc->mux_setting = NULL; + mutex_unlock(&desc->mux_lock); + } } err_pin_request: /* On error release all taken pins */ @@ -491,6 +505,7 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) unsigned num_pins = 0; int i; struct pin_desc *desc; + bool is_equal; if (pctlops->get_group_pins) ret = pctlops->get_group_pins(pctldev, setting->data.mux.group, @@ -516,7 +531,11 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } - if (desc->mux_setting == &(setting->data.mux)) { + mutex_lock(&desc->mux_lock); + is_equal = (desc->mux_setting == &(setting->data.mux)); + mutex_unlock(&desc->mux_lock); + + if (is_equal) { pin_free(pctldev, pins[i], NULL); } else { const char *gname; @@ -608,6 +627,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) if (desc == NULL) continue; + mutex_lock(&desc->mux_lock); if (desc->mux_owner && !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev))) is_hog = true; @@ -642,6 +662,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) desc->mux_setting->group)); else seq_putc(s, '\n'); + mutex_unlock(&desc->mux_lock); } mutex_unlock(&pctldev->mutex); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56724
by Liao Chen 06 Feb '25

06 Feb '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] brd: fix AA deadlock for concurrent brd_probe()
by Yu Kuai 06 Feb '25

06 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIWBN CVE: NA ---------------------------------------- For concurrent brd_probe(), the first one will create brd disk and set partition number to 0, however, the second one will found the brd disk and keep the partition number as disk fist minor. This will case AA deadlock for the caller because bdev is part0 while bdev->bd_partno is not zero. Fix the problem by always return NULL in brd_probe, hence brd_probe() will be covered by exact_match() from __device_add_disk(). Fixes: 937af5ecd059 ("brd: Fix all partitions BUGs") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/block/brd.c | 30 ++++++------------------------ 1 file changed, 6 insertions(+), 24 deletions(-) diff --git a/drivers/block/brd.c b/drivers/block/brd.c index 02e8fff3f828..6a74b91126f0 100644 --- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -418,25 +418,15 @@ static void brd_free(struct brd_device *brd) kfree(brd); } -static struct brd_device *brd_init_one(int i, bool *new) +static void brd_init_one(int i) { struct brd_device *brd; - *new = false; - list_for_each_entry(brd, &brd_devices, brd_list) { + list_for_each_entry(brd, &brd_devices, brd_list) if (brd->brd_number == i) - goto out; - } + return; - brd = brd_alloc(i); - if (brd) { - brd->brd_disk->queue = brd->brd_queue; - add_disk(brd->brd_disk); - list_add_tail(&brd->brd_list, &brd_devices); - } - *new = true; -out: - return brd; + brd_alloc(i); } static void brd_del_one(struct brd_device *brd) @@ -448,19 +438,11 @@ static void brd_del_one(struct brd_device *brd) static struct kobject *brd_probe(dev_t dev, int *part, void *data) { - struct brd_device *brd; - struct kobject *kobj; - bool new; - mutex_lock(&brd_devices_mutex); - brd = brd_init_one(MINOR(dev) / max_part, &new); - kobj = brd ? get_disk_and_module(brd->brd_disk) : NULL; + brd_init_one(MINOR(dev) / max_part); mutex_unlock(&brd_devices_mutex); - if (new) - *part = 0; - - return kobj; + return NULL; } static inline void brd_check_and_reset_par(void) -- 2.39.2

3 2

[PATCH OLK-5.10] brd: fix AA deadlock for concurrent brd_probe()
by Yu Kuai 06 Feb '25

06 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIWBN CVE: NA ---------------------------------------- For concurrent brd_probe(), the first one will create brd disk and set partition number to 0, however, the second one will found the brd disk and keep the partition number as disk fist minor. This will case AA deadlock for the caller because bdev is part0 while bdev->bd_partno is not zero. Fix the problem by always return NULL in brd_probe, hence brd_probe() will be covered by exact_match() from __device_add_disk(). Fixes: 937af5ecd059 ("brd: Fix all partitions BUGs") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/block/brd.c | 32 ++++++-------------------------- 1 file changed, 6 insertions(+), 26 deletions(-) diff --git a/drivers/block/brd.c b/drivers/block/brd.c index bb3ccaebc9aa..1bbfc8c3d1eb 100644 --- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -429,27 +429,15 @@ static int brd_alloc(int i) return err; } -static struct brd_device *brd_init_one(int i, bool *new) +static void brd_init_one(int i) { struct brd_device *brd; - int err; - *new = false; - list_for_each_entry(brd, &brd_devices, brd_list) { + list_for_each_entry(brd, &brd_devices, brd_list) if (brd->brd_number == i) - goto out; - } + return; - *new = true; - err = brd_alloc(i); - if (err) - return NULL; - list_for_each_entry(brd, &brd_devices, brd_list) { - if (brd->brd_number == i) - goto out; - } -out: - return brd; + brd_alloc(i); } static void brd_del_one(struct brd_device *brd) @@ -463,19 +451,11 @@ static void brd_del_one(struct brd_device *brd) static struct kobject *brd_probe(dev_t dev, int *part, void *data) { - struct brd_device *brd; - struct kobject *kobj; - bool new; - mutex_lock(&brd_devices_mutex); - brd = brd_init_one(MINOR(dev) / max_part, &new); - kobj = brd ? get_disk_and_module(brd->brd_disk) : NULL; + brd_init_one(MINOR(dev) / max_part); mutex_unlock(&brd_devices_mutex); - if (new) - *part = 0; - - return kobj; + return NULL; } static inline void brd_check_and_reset_par(void) -- 2.39.2

2 1

[PATCH OLK-6.6] nbd: don't allow reconnect after disconnect
by Yu Kuai 06 Feb '25

06 Feb '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGB8Q CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commi… ---------------------------------------- Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference: nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail. Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command") Reported-by: syzbot+6b0df248918b92c33e6a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/ Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> --- drivers/block/nbd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 74d1f9c26ecc..7eeb4b6de6de 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2169,6 +2169,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) flush_workqueue(nbd->recv_workq); nbd_clear_que(nbd); nbd->task_setup = NULL; + clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); mutex_unlock(&nbd->config_lock); if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] nbd: don't allow reconnect after disconnect
by Yu Kuai 06 Feb '25

06 Feb '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGB8Q CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commi… ---------------------------------------- Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference: nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail. Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command") Reported-by: syzbot+6b0df248918b92c33e6a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/ Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> --- drivers/block/nbd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 9d413c4fd64c..fbc4cdb5a5b9 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2083,6 +2083,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) mutex_lock(&nbd->config_lock); nbd_disconnect(nbd); nbd_clear_sock(nbd); + clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); mutex_unlock(&nbd->config_lock); /* * Make sure recv thread has finished, so it does not drop the last -- 2.39.2

2 1