- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] tcp/udp: Fix memory leak in ipv6_renew_options().
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.1-rc1 commit 3c52c6bb831f6335c176a0fc7214e26f43adbd11 category: bugfix bugzilla: 187825, https://gitee.com/src-openeuler/kernel/issues/I5VZ0J CVE: CVE-2022-3524 -------------------------------- syzbot reported a memory leak [0] related to IPV6_ADDRFORM. The scenario is that while one thread is converting an IPv6 socket into IPv4 with IPV6_ADDRFORM, another thread calls do_ipv6_setsockopt() and allocates memory to inet6_sk(sk)->XXX after conversion. Then, the converted sk with (tcp|udp)_prot never frees the IPv6 resources, which inet6_destroy_sock() should have cleaned up. setsockopt(IPV6_ADDRFORM) setsockopt(IPV6_DSTOPTS) +-----------------------+ +----------------------+ - do_ipv6_setsockopt(sk, ...) - sockopt_lock_sock(sk) - do_ipv6_setsockopt(sk, ...) - lock_sock(sk) ^._ called via tcpv6_prot - WRITE_ONCE(sk->sk_prot, &tcp_prot) before WRITE_ONCE() - xchg(&np->opt, NULL) - txopt_put(opt) - sockopt_release_sock(sk) - release_sock(sk) - sockopt_lock_sock(sk) - lock_sock(sk) - ipv6_set_opt_hdr(sk, ...) - ipv6_update_options(sk, opt) - xchg(&inet6_sk(sk)->opt, opt) ^._ opt is never freed. - sockopt_release_sock(sk) - release_sock(sk) Since IPV6_DSTOPTS allocates options under lock_sock(), we can avoid this memory leak by testing whether sk_family is changed by IPV6_ADDRFORM after acquiring the lock. This issue exists from the initial commit between IPV6_ADDRFORM and IPV6_PKTOPTIONS. [0]: BUG: memory leak unreferenced object 0xffff888009ab9f80 (size 96): comm "syz-executor583", pid 328, jiffies 4294916198 (age 13.034s) hex dump (first 32 bytes): 01 00 00 00 48 00 00 00 08 00 00 00 00 00 00 00 ....H........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002ee98ae1>] kmalloc include/linux/slab.h:605 [inline] [<000000002ee98ae1>] sock_kmalloc+0xb3/0x100 net/core/sock.c:2566 [<0000000065d7b698>] ipv6_renew_options+0x21e/0x10b0 net/ipv6/exthdrs.c:1318 [<00000000a8c756d7>] ipv6_set_opt_hdr net/ipv6/ipv6_sockglue.c:354 [inline] [<00000000a8c756d7>] do_ipv6_setsockopt.constprop.0+0x28b7/0x4350 net/ipv6/ipv6_sockglue.c:668 [<000000002854d204>] ipv6_setsockopt+0xdf/0x190 net/ipv6/ipv6_sockglue.c:1021 [<00000000e69fdcf8>] tcp_setsockopt+0x13b/0x2620 net/ipv4/tcp.c:3789 [<0000000090da4b9b>] __sys_setsockopt+0x239/0x620 net/socket.c:2252 [<00000000b10d192f>] __do_sys_setsockopt net/socket.c:2263 [inline] [<00000000b10d192f>] __se_sys_setsockopt net/socket.c:2260 [inline] [<00000000b10d192f>] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2260 [<000000000a80d7aa>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<000000000a80d7aa>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<000000004562b5c6>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv6/ipv6_sockglue.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index b2e03e84a2df..d3f3a2f79646 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -168,6 +168,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, rtnl_lock(); lock_sock(sk); + /* Another thread has converted the socket into IPv4 with + * IPV6_ADDRFORM concurrently. + */ + if (unlikely(sk->sk_family != AF_INET6)) + goto unlock; + switch (optname) { case IPV6_ADDRFORM: @@ -915,6 +921,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; } +unlock: release_sock(sk); if (needs_rtnl) rtnl_unlock(); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] net: mvpp2: fix mvpp2 debugfs leak
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: "Russell King (Oracle)" <rmk+kernel(a)armlinux.org.uk> mainline inclusion from mainline-v6.0-rc7 commit 0152dfee235e87660f52a117fc9f70dc55956bb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7AX CVE: CVE-2022-3535 -------------------------------- When mvpp2 is unloaded, the driver specific debugfs directory is not removed, which technically leads to a memory leak. However, this directory is only created when the first device is probed, so the hardware is present. Removing the module is only something a developer would to when e.g. testing out changes, so the module would be reloaded. So this memory leak is minor. The original attempt in commit fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") that was labelled as a memory leak fix was not, it fixed a refcount leak, but in doing so created a problem when the module is reloaded - the directory already exists, but mvpp2_root is NULL, so we lose all debugfs entries. This fix has been reverted. This is the alternative fix, where we remove the offending directory whenever the driver is unloaded. Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Parser") Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Marcin Wojtas <mw(a)semihalf.com> Link: https://lore.kernel.org/r/E1ofOAB-00CzkG-UO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/marvell/mvpp2/mvpp2.h drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 ++++++++-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 ++++++++++++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h index 46911b67b039..23f60bc5d48f 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h @@ -1107,5 +1107,6 @@ void mvpp2_percpu_write_relaxed(struct mvpp2 *priv, int cpu, u32 offset, void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name); void mvpp2_dbgfs_cleanup(struct mvpp2 *priv); +void mvpp2_dbgfs_exit(void); #endif diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c index f9744a61e5dd..d77414e1e704 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c @@ -660,6 +660,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent, return 0; } +static struct dentry *mvpp2_root; + +void mvpp2_dbgfs_exit(void) +{ + debugfs_remove(mvpp2_root); +} + void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) { debugfs_remove_recursive(priv->dbgfs_dir); @@ -667,10 +674,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) { - struct dentry *mvpp2_dir, *mvpp2_root; + struct dentry *mvpp2_dir; int ret, i; - mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL); if (!mvpp2_root) { mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); if (IS_ERR(mvpp2_root)) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index 04bee450eb3d..beb79455adc7 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -5412,7 +5412,18 @@ static struct platform_driver mvpp2_driver = { }, }; -module_platform_driver(mvpp2_driver); +static int __init mvpp2_driver_init(void) +{ + return platform_driver_register(&mvpp2_driver); +} +module_init(mvpp2_driver_init); + +static void __exit mvpp2_driver_exit(void) +{ + platform_driver_unregister(&mvpp2_driver); + mvpp2_dbgfs_exit(); +} +module_exit(mvpp2_driver_exit); MODULE_DESCRIPTION("Marvell PPv2 Ethernet Driver - www.marvell.com"); MODULE_AUTHOR("Marcin Wojtas <mw(a)semihalf.com>"); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] kcm: avoid potential race in kcm_tx_work
by Yongqiang Liu 19 Oct '22

19 Oct '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.1-rc1 commit ec7eede369fe5b0d085ac51fdbb95184f87bfc6c category: bugfix bugzilla: 187823, https://gitee.com/src-openeuler/kernel/issues/I5VZ0N CVE: CVE-2022-3521 -------------------------------- syzbot found that kcm_tx_work() could crash [1] in: /* Primarily for SOCK_SEQPACKET sockets */ if (likely(sk->sk_socket) && test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { <<*>> clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); sk->sk_write_space(sk); } I think the reason is that another thread might concurrently run in kcm_release() and call sock_orphan(sk) while sk is not locked. kcm_tx_work() find sk->sk_socket being NULL. [1] BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: null-ptr-deref in kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 Write of size 8 at addr 0000000000000008 by task kworker/u4:3/53 CPU: 0 PID: 53 Comm: kworker/u4:3 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: kkcmd kcm_tx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_write include/linux/instrumented.h:86 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Link: https://lore.kernel.org/r/20221012133412.519394-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/kcm/kcmsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index b919db02c7f9..dd83837f0fbf 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1839,10 +1839,10 @@ static int kcm_release(struct socket *sock) kcm = kcm_sk(sk); mux = kcm->mux; + lock_sock(sk); sock_orphan(sk); kfree_skb(kcm->seq_skb); - lock_sock(sk); /* Purge queue under lock to avoid race condition with tx_work trying * to act when queue is nonempty. If tx_work runs after this point * it will just return. -- 2.25.1

1 0

[PATCH openEuler-5.10 01/47] add config to control detecting conflict of opening block device
by Zheng Zengkai 19 Oct '22

19 Oct '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I53Q6M CVE: NA -------------------------------- We have a feature to add info when opening a write opend block device exclusively. Now we need to add switch to control it. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Chao Liu <liuchao173(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/Kconfig | 7 +++++++ fs/block_dev.c | 10 ++++++++++ include/linux/blk_types.h | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/block/Kconfig b/block/Kconfig index a2297edfdde8..e5c965f1ea25 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -202,6 +202,13 @@ config BLK_INLINE_ENCRYPTION_FALLBACK by falling back to the kernel crypto API when inline encryption hardware is not present. +config BLK_DEV_DUMPINFO + bool "Enable detecting conflict of opening block device" + default n + help + Dump info when open an write opened block device exclusively + or open an exclusive opened device for write + menu "Partition Types" source "block/partitions/Kconfig" diff --git a/fs/block_dev.c b/fs/block_dev.c index c8a3c93cc256..c55181b4a665 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1479,6 +1479,7 @@ int bdev_disk_changed(struct block_device *bdev, bool invalidate) */ EXPORT_SYMBOL_GPL(bdev_disk_changed); +#ifdef CONFIG_BLK_DEV_DUMPINFO static void blkdev_dump_conflict_opener(struct block_device *bdev, char *msg) { char name[BDEVNAME_SIZE]; @@ -1512,6 +1513,7 @@ static bool is_conflict_excl_open(struct block_device *bdev, struct block_device return !!whole->bd_write_openers; } +#endif /* * bd_mutex locking: * @@ -1631,6 +1633,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (for_part) bdev->bd_part_count++; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers++; @@ -1638,9 +1641,11 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, bdev->bd_contains->bd_part_write_openers++; spin_unlock(&bdev_lock); } +#endif if (claiming) { spin_lock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO /* * Open an write opened block device exclusively, the * writing process may probability corrupt the device, @@ -1649,8 +1654,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (is_conflict_excl_open(bdev, claiming, mode)) blkdev_dump_conflict_opener(bdev, "VFS: Open an write opened " "block device exclusively"); +#endif bd_finish_claiming(bdev, claiming, holder); spin_unlock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO } else if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); /* @@ -1663,6 +1670,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, blkdev_dump_conflict_opener(bdev, "VFS: Open an exclusive opened " "block device for write"); spin_unlock(&bdev_lock); +#endif } /* @@ -1881,6 +1889,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) if (for_part) bdev->bd_part_count--; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers--; @@ -1888,6 +1897,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) bdev->bd_contains->bd_part_write_openers--; spin_unlock(&bdev_lock); } +#endif if (!--bdev->bd_openers) { WARN_ON_ONCE(bdev->bd_holders); diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index bbb62ff84601..fbea6b0aef3e 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -48,7 +48,7 @@ struct block_device { int bd_fsfreeze_count; /* Mutex for freeze */ struct mutex bd_fsfreeze_mutex; -#ifndef __GENKSYMS__ +#if defined(CONFIG_BLK_DEV_DUMPINFO) && !defined(__GENKSYMS__) KABI_USE2(1, int bd_write_openers, int bd_part_write_openers); #else KABI_RESERVE(1) -- 2.20.1

1 46

[PATCH openEuler-5.10-LTS 000/168] Backport 5.10.122 LTS
by Zheng Zengkai 18 Oct '22

18 Oct '22

Backport 5.10.122 LTS patches from upstream. git cherry-pick v5.10.121..v5.10.122~1 -s Already merged(-6): 36ee9ffca8ef driver core: fix deadlock in __device_attach 6d8d3f68cbec ubi: ubi_create_volume: Fix use-after-free when volume creation failed c0868f6e728c nbd: call genl_unregister_family() first in nbd_cleanup() 122e4adaff24 nbd: fix race between nbd_alloc_config() and module removal f72df77600a4 nbd: fix io hung while disconnecting device 3be74fc0afbe powerpc/32: Fix overread/overwrite of thread_struct via ptrace Total patches: 174 - 6 = 168 Adrian Hunter (1): mmc: block: Fix CQE recovery reset success Alexander Lobakin (1): modpost: fix removing numeric suffixes Alexandru Tachici (1): iio: adc: ad7124: Remove shift from scan_type Alexey Kardashevskiy (1): powerpc/mm: Switch obsolete dssall to .long Andre Przywara (1): clocksource/drivers/sp804: Avoid error on multiple instances Baokun Li (1): jffs2: fix memory leak in jffs2_do_fill_super Bjorn Andersson (1): usb: typec: mux: Check dev_set_name() return value Brian Norris (2): drm/bridge: analogix_dp: Support PSR-exit to disable transition drm/atomic: Force bridge self-refresh-exit on CRTC switch Cameron Berkenpas (1): ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 Changbin Du (1): sysrq: do not omit current cpu when showing backtrace of all active CPUs Changcheng Liu (1): net/mlx5: correct ECE offset in query qp output Christian Borntraeger (1): s390/gmap: voluntarily schedule during key setting Christophe JAILLET (1): staging: fieldbus: Fix the error handling path in anybuss_host_common_probe() Chuck Lever (1): SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() Cixi Geng (2): iio: adc: sc27xx: fix read big scale voltage not right iio: adc: sc27xx: Fine tune the scale calibration values Damien Le Moal (2): scsi: sd: Fix potential NULL pointer dereference zonefs: fix handling of explicit_open option on mount Dan Carpenter (1): net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() Daniel Gibson (1): tty: n_tty: Restore EOF push handling behavior Dave Jiang (2): dmaengine: idxd: set DMA_INTERRUPT cap bit dmaengine: idxd: add missing callback function to support DMA_INTERRUPT David Howells (1): afs: Fix infinite loop found by xfstest generic/676 Dongliang Mu (1): f2fs: remove WARN_ON in f2fs_is_valid_blkaddr Duoming Zhou (4): drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() drivers: tty: serial: Fix deadlock in sa1100_set_termios() drivers: usb: host: Fix deadlock in oxu_bus_suspend() Eric Dumazet (3): tcp: tcp_rtx_synack() can be called from process context bpf, arm64: Clear prog->jited_len along prog->jited tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd Evan Green (1): USB: hcd-pci: Fully suspend across freeze/thaw cycle Feras Daoud (1): net/mlx5: Rearm the FW tracer after each tracer event Florian Westphal (1): netfilter: nat: really support inet nat without l3 address Gal Pressman (1): net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure Gong Yuanjun (2): mips: cpc: Fix refcount leak in mips_cpc_default_phys_base drm/radeon: fix a possible null pointer dereference Greg Ungerer (2): m68knommu: set ZERO_PAGE() to the allocated zeroed page m68knommu: fix undefined reference to `_init_sp' Guangguan Wang (1): net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" Guilherme G. Piccoli (1): coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier Guoju Fang (1): net: sched: add barrier to fix packet stuck problem for lockless qdisc Guoqing Jiang (1): md: protect md_unregister_thread from reentrancy Haibo Chen (1): gpio: pca953x: use the correct register address to do regcache sync Hangyu Hua (1): usb: usbip: fix a refcount leak in stub_probe() Hannes Reinecke (1): scsi: myrb: Fix up null pointer access on myrb_cleanup() Hao Luo (1): kernfs: Separate kernfs_pr_cont_buf and rename_lock. Heinrich Schuchardt (1): riscv: read-only pages should not be writable Hoang Le (1): tipc: check attribute length for bearer name Huang Guobin (1): tty: Fix a possible resource leak in icom_probe Ilpo Järvinen (8): serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 serial: digicolor-usart: Don't allow CS5-6 serial: rda-uart: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: sh-sci: Don't allow CS5-6 serial: sifive: Sanitize CSIZE and c_iflag serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 serial: stm32-usart: Correct CSIZE, bits, and parity Jakob Koschel (1): staging: greybus: codecs: fix type confusion of list iterator variable Jann Horn (1): s390/crypto: fix scatterwalk_unmap() callers in AES-GCM Jiasheng Jiang (1): lkdtm/bugs: Check for the NULL pointer after calling kmalloc Johan Hovold (2): phy: qcom-qmp: fix pipe-clock imbalance on power-on failure PCI: qcom: Fix pipe clock imbalance John Ogness (2): serial: meson: acquire port->lock in startup() serial: msm_serial: disable interrupts in __msm_console_write() Jun Miao (1): tracing: Fix sleeping function called from invalid context on RT kernel Kees Cook (2): lkdtm/usercopy: Expand size of "out of frame" object nodemask: Fix return values to be unsigned Kinglong Mee (1): xprtrdma: treat all calls not a bcall when bc_serv is NULL Krzysztof Kozlowski (3): rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value Kuan-Ying Lee (1): scripts/gdb: change kernel config dumping method Kuniyuki Iwashima (1): af_unix: Fix a data-race in unix_dgram_peer_wake_me(). Leo Yan (1): perf c2c: Fix sorting in percent_rmt_hitm_cmp() Leon Romanovsky (1): net/mlx5: Don't use already freed action pointer Li Jun (1): extcon: ptn5150: Add queue work sync before driver release Lin Ma (1): USB: storage: karma: fix rio_karma_init return Linus Torvalds (1): drm: imx: fix compiler warning with gcc-12 Liu Xinpeng (1): watchdog: wdat_wdt: Stop watchdog when rebooting the system Lucas Tanure (1): i2c: cadence: Increase timeout per message if necessary Maciej W. Rozycki (1): serial: sifive: Report actual baud base rather than fixed 115200 Marek Szyprowski (1): usb: dwc2: gadget: don't reset gadget's driver->bus Mark Bloch (1): net/mlx5: fs, fail conflicting actions Mark-PK Tsai (1): tracing: Avoid adding tracer option before update_tracer_options Martin Faltesek (3): nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION Martin Habets (1): sfc: fix considering that all channels have TX queues Masahiro Yamada (5): xen: unexport __init-annotated xen_xlate_map_ballooned_pages() net: mdio: unexport __init-annotated mdio_bus_init() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: ipv6: unexport __init-annotated seg6_hmac_init() modpost: fix undefined behavior of is_arm_mapping_symbol() Masami Hiramatsu (1): bootconfig: Make the bootconfig.o as a normal object file Mathias Nyman (1): Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag Maxim Mikityanskiy (1): net/mlx5e: Update netdev features after changing XDP state Menglong Dong (1): bpf: Fix probe read error in ___bpf_prog_run() Miaoqian Lin (13): tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe usb: musb: Fix missing of_node_put() in omap2430_probe iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout soc: rockchip: Fix refcount leak in rockchip_grf_init firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list net: altera: Fix refcount leak in altera_tse_mdio_create Michael Ellerman (1): powerpc/kasan: Force thread size increase with KASAN Michal Kubecek (1): Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" Miquel Raynal (1): iio: st_sensors: Add a local lock for protecting odr Niels Dossche (1): usb: usbip: add missing device lock on tweak configuration cmd Olivier Matz (2): ixgbe: fix bcast packets Rx on VF after promisc removal ixgbe: fix unexpected VLAN Rx in promisc mode on VF Pablo Neira Ayuso (5): netfilter: nf_tables: delete flowtable hooks via transaction list netfilter: nf_tables: always initialize flowtable hook list in transaction netfilter: nf_tables: release new hooks on unsupported flowtable flags netfilter: nf_tables: memleak flow rule from commit path netfilter: nf_tables: bail out early if hardware offload is not supported Pascal Hambourg (1): md/raid0: Ignore RAID0 layout if the second zone has only one device Paulo Alcantara (1): cifs: fix reconnect on smb3 mount types Peter Zijlstra (2): x86/cpu: Elide KCSAN for cpu_has() and friends jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds Radhey Shyam Pandey (1): dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type Randy Dunlap (1): pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards Samuel Holland (1): clocksource/drivers/riscv: Events are stopped during CPU suspend Saravana Kannan (1): driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction Saurabh Sengar (1): video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 Schspa Shi (1): driver: base: fix UAF when driver_attach failed Sergey Shtylyov (1): ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files Shengjiu Wang (1): ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition Sherry Sun (1): tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get Shuah Khan (1): misc: rtsx: set NULL intfdata when probe fails Shyam Prasad N (1): cifs: return errors during session setup during reconnects Stephen Boyd (2): interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: Restore sync state by ignoring ipa-virt in provider count Steve French (1): cifs: version operations for smb20 unneeded when legacy support disabled Tan Tee Min (1): net: phy: dp83867: retrigger SGMII AN when link change Tony Lindgren (1): bus: ti-sysc: Fix warnings for unbind for serial Trond Myklebust (1): NFSv4: Don't hold the layoutget locks across multiple RPC calls Uwe Kleine-König (1): pwm: lp3943: Fix duty calculation in case period was clamped Venky Shankar (1): ceph: allow ceph.dir.rctime xattr to be updatable Vincent Ray (1): net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog Wang Cheng (2): staging: rtl8712: fix uninit-value in usb_read8() and friends staging: rtl8712: fix uninit-value in r871xu_drv_init() Wang Weiyang (1): tty: goldfish: Use tty_port_destroy() to destroy port Willem de Bruijn (1): ip_gre: test csum_start instead of transport header Xiaoke Wang (2): iio: dummy: iio_simple_dummy: check the return value of kstrdup() staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Xiaomeng Tong (2): misc: fastrpc: fix an incorrect NULL check on list iterator firmware: stratix10-svc: fix a missing check on list iterator Xie Yongji (1): vringh: Fix loop descriptors check in the indirect cases Yang Yingliang (4): rtc: mt6397: check return value after calling platform_get_resource() iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() iommu/arm-smmu-v3: check return value after calling platform_get_resource() video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() Yu Xiao (1): nfp: only report pause frame configuration for physical device Zhen Ni (1): USB: host: isp116x: check return value after calling platform_get_resource() Zheng Yongjun (1): usb: dwc3: pci: Fix pm_runtime_get_sync() error checking Zheyu Ma (1): tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Zhihao Cheng (1): ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty bumwoo lee (1): extcon: Modify extcon device to be created after driver data is set huangwenhui (1): ALSA: hda/conexant - Fix loopback issue with CX20632 Íñigo Huguet (1): sfc: fix wrong tx channel offset with efx_separate_tx_channels Documentation/ABI/testing/sysfs-ata | 11 ++-- arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.machine | 1 + arch/m68k/include/asm/pgtable_no.h | 3 +- arch/mips/kernel/mips-cpc.c | 1 + arch/powerpc/Kconfig | 1 - arch/powerpc/include/asm/ppc-opcode.h | 2 + arch/powerpc/include/asm/thread_info.h | 10 +++- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/kernel/idle_6xx.S | 2 +- arch/powerpc/kernel/l2cr_6xx.S | 6 +-- arch/powerpc/kernel/swsusp_32.S | 2 +- arch/powerpc/kernel/swsusp_asm64.S | 2 +- arch/powerpc/mm/mmu_context.c | 2 +- arch/powerpc/platforms/powermac/cache.S | 4 +- arch/riscv/kernel/efi.c | 2 +- arch/s390/crypto/aes_s390.c | 4 +- arch/s390/mm/gmap.c | 14 +++++ arch/x86/include/asm/cpufeature.h | 2 +- drivers/ata/libata-transport.c | 2 +- drivers/ata/pata_octeon_cf.c | 3 ++ drivers/base/bus.c | 4 +- drivers/base/dd.c | 5 -- drivers/bus/ti-sysc.c | 4 +- drivers/clocksource/timer-oxnas-rps.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/clocksource/timer-sp804.c | 10 ++-- drivers/dma/idxd/dma.c | 23 ++++++++ drivers/dma/xilinx/zynqmp_dma.c | 5 +- drivers/extcon/extcon-ptn5150.c | 11 ++++ drivers/extcon/extcon.c | 29 +++++----- drivers/firmware/dmi-sysfs.c | 2 +- drivers/firmware/stratix10-svc.c | 12 ++--- drivers/gpio/gpio-pca953x.c | 19 ++++--- .../drm/bridge/analogix/analogix_dp_core.c | 42 +++++++++++++-- drivers/gpu/drm/drm_atomic_helper.c | 16 ++++-- drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++ .../hwtracing/coresight/coresight-cpu-debug.c | 7 +-- drivers/i2c/busses/i2c-cadence.c | 12 ++++- drivers/iio/adc/ad7124.c | 1 - drivers/iio/adc/sc27xx_adc.c | 20 +++---- drivers/iio/adc/stmpe-adc.c | 8 +-- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++--- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++--- drivers/iio/proximity/vl53l0x-i2c.c | 7 ++- drivers/input/mouse/bcm5974.c | 7 ++- drivers/interconnect/core.c | 7 ++- drivers/interconnect/qcom/sc7180.c | 21 -------- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu.c | 5 +- drivers/md/md.c | 15 ++++-- drivers/md/raid0.c | 31 +++++------ drivers/misc/cardreader/rtsx_usb.c | 1 + drivers/misc/fastrpc.c | 9 ++-- drivers/misc/lkdtm/bugs.c | 5 ++ drivers/misc/lkdtm/usercopy.c | 17 ++++-- drivers/mmc/core/block.c | 3 +- drivers/mtd/ubi/ubi.h | 4 +- drivers/net/dsa/lantiq_gswip.c | 4 +- drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/altera/altera_tse_main.c | 6 ++- .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 +-- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 ++ .../net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- .../mellanox/mlx5/core/diag/fw_tracer.c | 7 ++- .../net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++ .../net/ethernet/mellanox/mlx5/core/fs_core.c | 35 ++++++++++-- .../mellanox/mlx5/core/steering/fs_dr.c | 9 ++-- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 4 +- drivers/net/ethernet/sfc/efx_channels.c | 6 +-- drivers/net/ethernet/sfc/net_driver.h | 2 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 +- drivers/net/phy/dp83867.c | 29 ++++++++++ drivers/net/phy/mdio_bus.c | 1 - drivers/nfc/st21nfca/se.c | 53 +++++++++++-------- drivers/pci/controller/dwc/pcie-qcom.c | 6 --- drivers/pcmcia/Kconfig | 2 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- drivers/pwm/pwm-lp3943.c | 1 + drivers/rpmsg/qcom_smd.c | 4 +- drivers/rtc/rtc-mt6397.c | 2 + drivers/scsi/myrb.c | 11 ++-- drivers/scsi/sd.c | 1 - drivers/soc/rockchip/grf.c | 2 + drivers/staging/fieldbus/anybuss/host.c | 2 +- drivers/staging/greybus/audio_codec.c | 4 +- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- .../rtl8192u/ieee80211/ieee80211_softmac.c | 2 +- drivers/staging/rtl8712/os_intfs.c | 1 - drivers/staging/rtl8712/usb_intf.c | 12 ++--- drivers/staging/rtl8712/usb_ops.c | 27 ++++++---- drivers/tty/goldfish.c | 2 + drivers/tty/n_tty.c | 38 ++++++++++++- drivers/tty/serial/8250/8250_fintek.c | 8 +-- drivers/tty/serial/digicolor-usart.c | 2 + drivers/tty/serial/fsl_lpuart.c | 24 ++------- drivers/tty/serial/icom.c | 2 +- drivers/tty/serial/meson_uart.c | 13 +++++ drivers/tty/serial/msm_serial.c | 5 ++ drivers/tty/serial/owl-uart.c | 1 + drivers/tty/serial/rda-uart.c | 2 + drivers/tty/serial/sa1100.c | 4 +- drivers/tty/serial/serial_txx9.c | 2 + drivers/tty/serial/sh-sci.c | 6 ++- drivers/tty/serial/sifive.c | 8 ++- drivers/tty/serial/st-asc.c | 4 ++ drivers/tty/serial/stm32-usart.c | 15 ++++-- drivers/tty/synclink_gt.c | 2 + drivers/tty/sysrq.c | 13 +++-- drivers/usb/core/hcd-pci.c | 4 +- drivers/usb/dwc2/gadget.c | 1 - drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/host/isp116x-hcd.c | 6 ++- drivers/usb/host/oxu210hp-hcd.c | 2 + drivers/usb/musb/omap2430.c | 1 + drivers/usb/storage/karma.c | 15 +++--- drivers/usb/typec/mux.c | 14 +++-- drivers/usb/usbip/stub_dev.c | 2 +- drivers/usb/usbip/stub_rx.c | 2 + drivers/vhost/vringh.c | 10 +++- drivers/video/fbdev/hyperv_fb.c | 19 +------ drivers/video/fbdev/pxa3xx-gcu.c | 12 +++-- drivers/watchdog/rti_wdt.c | 2 +- drivers/watchdog/ts4800_wdt.c | 5 +- drivers/watchdog/wdat_wdt.c | 1 + drivers/xen/xlate_mmu.c | 1 - fs/afs/dir.c | 5 +- fs/ceph/xattr.c | 10 +++- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsfs.h | 2 +- fs/cifs/cifsglob.h | 4 +- fs/cifs/misc.c | 27 ++++++---- fs/cifs/smb2ops.c | 7 ++- fs/cifs/smb2pdu.c | 3 ++ fs/f2fs/checkpoint.c | 4 +- fs/jffs2/fs.c | 1 + fs/kernfs/dir.c | 31 ++++++----- fs/nfs/nfs4proc.c | 4 ++ fs/zonefs/super.c | 11 ++-- include/linux/iio/common/st_sensors.h | 3 ++ include/linux/jump_label.h | 4 +- include/linux/mlx5/mlx5_ifc.h | 5 +- include/linux/nodemask.h | 38 ++++++------- include/net/flow_offload.h | 1 + include/net/netfilter/nf_tables.h | 1 - include/net/netfilter/nf_tables_offload.h | 2 +- include/net/sch_generic.h | 42 +++++---------- kernel/bpf/core.c | 14 ++--- kernel/trace/trace.c | 13 +++-- lib/Makefile | 2 +- lib/nodemask.c | 4 +- net/core/flow_offload.c | 6 +++ net/ipv4/ip_gre.c | 11 ++-- net/ipv4/tcp_input.c | 11 ++-- net/ipv4/tcp_output.c | 4 +- net/ipv4/xfrm4_protocol.c | 1 - net/ipv6/seg6_hmac.c | 1 - net/key/af_key.c | 10 ++-- net/netfilter/nf_tables_api.c | 52 ++++++++---------- net/netfilter/nf_tables_offload.c | 23 +++++++- net/netfilter/nft_nat.c | 3 +- net/smc/smc_cdc.c | 2 +- net/sunrpc/xdr.c | 6 ++- net/sunrpc/xprtrdma/rpc_rdma.c | 5 ++ net/tipc/bearer.c | 3 +- net/unix/af_unix.c | 2 +- scripts/gdb/linux/config.py | 6 +-- scripts/mod/modpost.c | 5 +- sound/pci/hda/patch_conexant.c | 7 +++ sound/pci/hda/patch_realtek.c | 1 + sound/soc/fsl/fsl_sai.h | 4 +- tools/perf/builtin-c2c.c | 4 +- tools/testing/selftests/netfilter/nft_nat.sh | 43 +++++++++++++++ 174 files changed, 946 insertions(+), 508 deletions(-) -- 2.20.1

1 168

[PATCH openEuler-22.03-LTS-Ascend 01/79] mm/sharepool: Support read-only memory allocation
by Zheng Zengkai 18 Oct '22

18 Oct '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> Offering: HULK ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DS9S -------------------------------- When the driver uses the shared pool memory to share the memory with the user space, the user space is not allowed to operate this area. This prevents users from damaging sensitive data. When the sp_alloc and k2u processes apply for private memory, read-only memory can be applied for. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> --- include/linux/share_pool.h | 3 ++- mm/share_pool.c | 18 ++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 6f294911c6af..5539a17da7a9 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -15,6 +15,7 @@ #define SP_HUGEPAGE_ONLY (1 << 1) #define SP_DVPP (1 << 2) #define SP_SPEC_NODE_ID (1 << 3) +#define SP_PROT_RO (1 << 16) #define DEVICE_ID_BITS 4UL #define DEVICE_ID_MASK ((1UL << DEVICE_ID_BITS) - 1UL) @@ -24,7 +25,7 @@ #define NODE_ID_SHIFT (DEVICE_ID_SHIFT + DEVICE_ID_BITS) #define SP_FLAG_MASK (SP_HUGEPAGE | SP_HUGEPAGE_ONLY | SP_DVPP | \ - SP_SPEC_NODE_ID | \ + SP_SPEC_NODE_ID | SP_PROT_RO | \ (DEVICE_ID_MASK << DEVICE_ID_SHIFT) | \ (NODE_ID_MASK << NODE_ID_SHIFT)) diff --git a/mm/share_pool.c b/mm/share_pool.c index 76088952d0a5..99f25a551afc 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2331,6 +2331,9 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, if (spg_node) prot = spg_node->prot; + if (ac->sp_flags & SP_PROT_RO) + prot = PROT_READ; + /* when success, mmap_addr == spa->va_start */ mmap_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(mmap_addr)) { @@ -2355,6 +2358,10 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, ret = -EINVAL; goto unmap; } + + if (ac->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + /* clean PTE_RDONLY flags or trigger SMMU event */ if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); @@ -2650,6 +2657,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, goto put_mm; } + if (kc && kc->sp_flags & SP_PROT_RO) + prot = PROT_READ; + ret_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(ret_addr)) { pr_debug("k2u mmap failed %lx\n", ret_addr); @@ -2662,6 +2672,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); + if (kc && kc->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + if (is_vm_hugetlb_page(vma)) { ret = remap_vmalloc_hugepage_range(vma, (void *)kva, 0); if (ret) { @@ -2713,6 +2726,7 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un struct sp_area *spa; struct spg_proc_stat *stat; unsigned long prot = PROT_READ | PROT_WRITE; + struct sp_k2u_context kc; down_write(&sp_group_sem); stat = sp_init_process_stat(current, current->mm, spg_none); @@ -2731,8 +2745,8 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un } spa->kva = kva; - - uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, NULL); + kc.sp_flags = sp_flags; + uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, &kc); __sp_area_drop(spa); if (IS_ERR(uva)) pr_err("remap k2u to task failed %ld\n", PTR_ERR(uva)); -- 2.20.1

1 78

[PATCH openEuler-5.10-LTS 01/12] mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
by Zheng Zengkai 18 Oct '22

18 Oct '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.141 commit 98f401d36396134c0c86e9e3bd00b6b6b028b521 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5USOP CVE: CVE-2022-42703 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2555283eb40df89945557273121e9393ef9b542b upstream. anon_vma->degree tracks the combined number of child anon_vmas and VMAs that use the anon_vma as their ->anon_vma. anon_vma_clone() then assumes that for any anon_vma attached to src->anon_vma_chain other than src->anon_vma, it is impossible for it to be a leaf node of the VMA tree, meaning that for such VMAs ->degree is elevated by 1 because of a child anon_vma, meaning that if ->degree equals 1 there are no VMAs that use the anon_vma as their ->anon_vma. This assumption is wrong because the ->degree optimization leads to leaf nodes being abandoned on anon_vma_clone() - an existing anon_vma is reused and no new parent-child relationship is created. So it is possible to reuse an anon_vma for one VMA while it is still tied to another VMA. This is an issue because is_mergeable_anon_vma() and its callers assume that if two VMAs have the same ->anon_vma, the list of anon_vmas attached to the VMAs is guaranteed to be the same. When this assumption is violated, vma_merge() can merge pages into a VMA that is not attached to the corresponding anon_vma, leading to dangling page->mapping pointers that will be dereferenced during rmap walks. Fix it by separately tracking the number of child anon_vmas and the number of VMAs using the anon_vma as their ->anon_vma. Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") Cc: stable(a)kernel.org Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/rmap.h | 7 +++++-- mm/rmap.c | 29 ++++++++++++++++------------- 2 files changed, 21 insertions(+), 15 deletions(-) diff --git a/include/linux/rmap.h b/include/linux/rmap.h index 8d04e7deedc6..297744ea4dd0 100644 --- a/include/linux/rmap.h +++ b/include/linux/rmap.h @@ -39,12 +39,15 @@ struct anon_vma { atomic_t refcount; /* - * Count of child anon_vmas and VMAs which points to this anon_vma. + * Count of child anon_vmas. Equals to the count of all anon_vmas that + * have ->parent pointing to this one, including itself. * * This counter is used for making decision about reusing anon_vma * instead of forking new one. See comments in function anon_vma_clone. */ - unsigned degree; + unsigned long num_children; + /* Count of VMAs whose ->anon_vma pointer points to this object. */ + unsigned long num_active_vmas; struct anon_vma *parent; /* Parent of this anon_vma */ diff --git a/mm/rmap.c b/mm/rmap.c index 0dc39cf94345..d0ef90af0567 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -89,7 +89,8 @@ static inline struct anon_vma *anon_vma_alloc(void) anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); if (anon_vma) { atomic_set(&anon_vma->refcount, 1); - anon_vma->degree = 1; /* Reference for first vma */ + anon_vma->num_children = 0; + anon_vma->num_active_vmas = 0; anon_vma->parent = anon_vma; /* * Initialise the anon_vma root to point to itself. If called @@ -197,6 +198,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) anon_vma = anon_vma_alloc(); if (unlikely(!anon_vma)) goto out_enomem_free_avc; + anon_vma->num_children++; /* self-parent link for new root */ allocated = anon_vma; } @@ -206,8 +208,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) if (likely(!vma->anon_vma)) { vma->anon_vma = anon_vma; anon_vma_chain_link(vma, avc, anon_vma); - /* vma reference or self-parent link for new root */ - anon_vma->degree++; + anon_vma->num_active_vmas++; allocated = NULL; avc = NULL; } @@ -292,19 +293,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) anon_vma_chain_link(dst, avc, anon_vma); /* - * Reuse existing anon_vma if its degree lower than two, - * that means it has no vma and only one anon_vma child. + * Reuse existing anon_vma if it has no vma and only one + * anon_vma child. * - * Do not chose parent anon_vma, otherwise first child - * will always reuse it. Root anon_vma is never reused: + * Root anon_vma is never reused: * it has self-parent reference and at least one child. */ if (!dst->anon_vma && src->anon_vma && - anon_vma != src->anon_vma && anon_vma->degree < 2) + anon_vma->num_children < 2 && + anon_vma->num_active_vmas == 0) dst->anon_vma = anon_vma; } if (dst->anon_vma) - dst->anon_vma->degree++; + dst->anon_vma->num_active_vmas++; unlock_anon_vma_root(root); return 0; @@ -354,6 +355,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) anon_vma = anon_vma_alloc(); if (!anon_vma) goto out_error; + anon_vma->num_active_vmas++; avc = anon_vma_chain_alloc(GFP_KERNEL); if (!avc) goto out_error_free_anon_vma; @@ -374,7 +376,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) vma->anon_vma = anon_vma; anon_vma_lock_write(anon_vma); anon_vma_chain_link(vma, avc, anon_vma); - anon_vma->parent->degree++; + anon_vma->parent->num_children++; anon_vma_unlock_write(anon_vma); return 0; @@ -406,7 +408,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) * to free them outside the lock. */ if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) { - anon_vma->parent->degree--; + anon_vma->parent->num_children--; continue; } @@ -414,7 +416,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) anon_vma_chain_free(avc); } if (vma->anon_vma) { - vma->anon_vma->degree--; + vma->anon_vma->num_active_vmas--; /* * vma would still be needed after unlink, and anon_vma will be prepared @@ -432,7 +434,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma) list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { struct anon_vma *anon_vma = avc->anon_vma; - VM_WARN_ON(anon_vma->degree); + VM_WARN_ON(anon_vma->num_children); + VM_WARN_ON(anon_vma->num_active_vmas); put_anon_vma(anon_vma); list_del(&avc->same_vma); -- 2.20.1

1 11

[PATCH openEuler-1.0-LTS] fbdev: smscufx: Fix use-after-free in ufx_ops_open()
by Yongqiang Liu 18 Oct '22

18 Oct '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v6.0-rc1 commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c category: bugfix bugzilla: 187798, https://gitee.com/src-openeuler/kernel/issues/I5U1NZ CVE: CVE-2022-41849 -------------------------------- A race condition may occur if the user physically removes the USB device while calling open() for this device node. This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF. So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions to avoid race contidion of krefs. Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/smscufx.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c index 22b606af0a87..2256e5816090 100644 --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -140,6 +140,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len); static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size); static void ufx_free_urb_list(struct ufx_data *dev); +static DEFINE_MUTEX(disconnect_mutex); + /* reads a control register */ static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data) { @@ -1073,9 +1075,13 @@ static int ufx_ops_open(struct fb_info *info, int user) if (user == 0 && !console) return -EBUSY; + mutex_lock(&disconnect_mutex); + /* If the USB device is gone, we don't accept new opens */ - if (dev->virtualized) + if (dev->virtualized) { + mutex_unlock(&disconnect_mutex); return -ENODEV; + } dev->fb_count++; @@ -1099,6 +1105,8 @@ static int ufx_ops_open(struct fb_info *info, int user) pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d", info->node, user, info, dev->fb_count); + mutex_unlock(&disconnect_mutex); + return 0; } @@ -1747,6 +1755,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) { struct ufx_data *dev; + mutex_lock(&disconnect_mutex); + dev = usb_get_intfdata(interface); pr_debug("USB disconnect starting\n"); @@ -1767,6 +1777,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) kref_put(&dev->kref, ufx_free); /* consider ufx_data freed */ + + mutex_unlock(&disconnect_mutex); } static struct usb_driver ufx_driver = { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] arm64: fix oops in concurrently setting insn_emulation sysctls
by Yongqiang Liu 18 Oct '22

18 Oct '22

From: haibinzhang (张海斌) <haibinzhang(a)tencent.com> stable inclusion from stable-v4.19.256 commit b51881b1da57fe9877125dfdd0aac5172958fcfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5U71M CVE: CVE-2022-20422 --------------------------- [ Upstream commit af483947d472eccb79e42059276c4deed76f99a6 ] emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently with itself: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | vfs_write+0xe4/0x1d0 | ksys_write+0x70/0xf8 | __arm64_sys_write+0x20/0x28 | el0_svc_common.constprop.0+0x7c/0x1c0 | el0_svc_handler+0x2c/0xa0 | el0_svc+0x8/0x200 To fix this issue, keep the table->data as &insn->current_mode and use container_of() to retrieve the insn pointer. Another mutex is used to protect against the current_mode update but not for retrieving insn_emulation as table->data is no longer changing. Co-developed-by: hewenliang <hewenliang4(a)huawei.com> Signed-off-by: hewenliang <hewenliang4(a)huawei.com> Signed-off-by: Haibin Zhang <haibinzhang(a)tencent.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ruanjinjie <ruanjinjie(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/kernel/armv8_deprecated.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c index 0cbf78581974..88d3454f2848 100644 --- a/arch/arm64/kernel/armv8_deprecated.c +++ b/arch/arm64/kernel/armv8_deprecated.c @@ -62,6 +62,7 @@ struct insn_emulation { static LIST_HEAD(insn_emulation); static int nr_insn_emulated __initdata; static DEFINE_RAW_SPINLOCK(insn_emulation_lock); +static DEFINE_MUTEX(insn_emulation_mutex); static void register_emulation_hooks(struct insn_emulation_ops *ops) { @@ -210,10 +211,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write, loff_t *ppos) { int ret = 0; - struct insn_emulation *insn = (struct insn_emulation *) table->data; + struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode); enum insn_emulation_mode prev_mode = insn->current_mode; - table->data = &insn->current_mode; + mutex_lock(&insn_emulation_mutex); ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); if (ret || !write || prev_mode == insn->current_mode) @@ -226,7 +227,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write, update_insn_emulation_mode(insn, INSN_UNDEF); } ret: - table->data = insn; + mutex_unlock(&insn_emulation_mutex); return ret; } @@ -250,7 +251,7 @@ static void __init register_insn_emulation_sysctl(void) sysctl->maxlen = sizeof(int); sysctl->procname = insn->ops->name; - sysctl->data = insn; + sysctl->data = &insn->current_mode; sysctl->extra1 = &insn->min; sysctl->extra2 = &insn->max; sysctl->proc_handler = emulation_proc_handler; -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] init/Kconfig: Add SMP to the dependencies of QOS_SCHED
by Yongqiang Liu 17 Oct '22

17 Oct '22

From: Xia Fukun <xiafukun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UPB0 CVE: NA ------------------------------------------------------------ After CONFIG_SMP is disabled during kernel compilation, CONFIG_QOS_SCHED is not disabled. As a result, the following error occurs: kernel/sched/fair.c: In function ‘check_qos_cfs_rq’: kernel/sched/fair.c:7324:4: error: implicit declaration of function ‘sched_idle_cpu’; did you mean ‘sched_idle_rq’? [-Werror=implicit-function-declaration] 7324 | !sched_idle_cpu(smp_processor_id()) && | ^~~~~~~~~~~~~~ ./include/linux/compiler.h:78:42: note: in definition of macro ‘unlikely’ 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ CC mm/highmem.o kernel/sched/fair.c: In function ‘pick_next_task_fair’: kernel/sched/fair.c:7599:43: error: ‘struct rq’ has no member named ‘online’ 7599 | if (cfs_rq->idle_h_nr_running != 0 && rq->online) | ^~ AR arch/x86/mm/pat/built-in.a CC kernel/sched/stats.o kernel/sched/fair.c:7790:7: error: ‘struct rq’ has no member named ‘idle_stamp’; did you mean ‘idle_state’? 7790 | rq->idle_stamp = 0; | ^~~~~~~~~~ | idle_state This is because the definitions of the corresponding functions and variables depend on the SMP configuration. So add SMP to the dependencies of QOS_SCHED. Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: zheng zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- init/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig b/init/Kconfig index 2c79f2e51fc4..a2a733080fe1 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -791,6 +791,7 @@ config QOS_SCHED bool "Qos task scheduling" depends on CGROUP_SCHED depends on CFS_BANDWIDTH + depends on SMP default n -- 2.25.1

1 1

2024

2023

2022

2021

2020

2019

Kernel