- Kernel - mailweb.openeuler.org

[PATCH] KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE
by Laibin Qiu 14 Sep '22

14 Sep '22

From: Andrew Murray <andrew.murray(a)arm.com> mainline inclusion from mainline-v5.6 commit 4942dc6638b07b5326b6d2faa142635c559e7cd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QR6C CVE: NA ------------- On VHE systems arch.mdcr_el2 is written to mdcr_el2 at vcpu_load time to set options for self-hosted debug and the performance monitors extension. Unfortunately the value of arch.mdcr_el2 is not calculated until kvm_arm_setup_debug() in the run loop after the vcpu has been loaded. This means that the initial brief iterations of the run loop use a zero value of mdcr_el2 - until the vcpu is preempted. This also results in a delay between changes to vcpu->guest_debug taking effect. Fix this by writing to mdcr_el2 in kvm_arm_setup_debug() on VHE systems when a change to arch.mdcr_el2 has been detected. Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions") Cc: <stable(a)vger.kernel.org> # 4.17.x- Suggested-by: James Morse <james.morse(a)arm.com> Acked-by: Will Deacon <will(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Andrew Murray <andrew.murray(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Zengruan Ye <yezengruan(a)huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm64/kvm/debug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c index 00d422336a45..4e722d73a3c3 100644 --- a/arch/arm64/kvm/debug.c +++ b/arch/arm64/kvm/debug.c @@ -112,7 +112,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) { bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY); - unsigned long mdscr; + unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2; trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug); @@ -208,6 +208,10 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE)) vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY; + /* Write mdcr_el2 changes since vcpu_load on VHE systems */ + if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2) + write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2); + trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2); trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1)); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] perf bench futex-wake: Restore thread count default to online CPU count
by tangbin 13 Sep '22

13 Sep '22

From: Tommi Rantala <tommi.t.rantala(a)nokia.com> stable inclusion from stable-v4.19.111 commit 5e8dff99645e574122aef5dec91b8803339a6362 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QSAP CVE: NA -------------------------------- commit f649bd9dd5d5004543bbc3c50b829577b49f5d75 upstream. Since commit 3b2323c2c1c4 ("perf bench futex: Use cpumaps") the default number of threads the benchmark uses got changed from number of online CPUs to zero: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 15930]: blocking on 0 threads (at [private] futex 0x558b8ee4bfac), waking up 1 at a time. [Run 1]: Wokeup 0 of 0 threads in 0.0000 ms [...] [Run 10]: Wokeup 0 of 0 threads in 0.0000 ms Wokeup 0 of 0 threads in 0.0004 ms (+-40.82%) Restore the old behavior by grabbing the number of online CPUs via cpu->nr: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 18356]: blocking on 8 threads (at [private] futex 0xb3e62c), waking up 1 at a time. [Run 1]: Wokeup 8 of 8 threads in 0.0260 ms [...] [Run 10]: Wokeup 8 of 8 threads in 0.0270 ms Wokeup 8 of 8 threads in 0.0419 ms (+-24.35%) Fixes: 3b2323c2c1c4 ("perf bench futex: Use cpumaps") Signed-off-by: Tommi Rantala <tommi.t.rantala(a)nokia.com> Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Darren Hart <dvhart(a)infradead.org> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Link: http://lore.kernel.org/lkml/20200305083714.9381-3-tommi.t.rantala@nokia.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- tools/perf/bench/futex-wake.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c index e8181ad7d088..e62006342b18 100644 --- a/tools/perf/bench/futex-wake.c +++ b/tools/perf/bench/futex-wake.c @@ -42,7 +42,7 @@ static bool done = false, silent = false, fshared = false; static pthread_mutex_t thread_lock; static pthread_cond_t thread_parent, thread_worker; static struct stats waketime_stats, wakeup_stats; -static unsigned int ncpus, threads_starting, nthreads = 0; +static unsigned int threads_starting, nthreads = 0; static int futex_flag = 0; static const struct option options[] = { @@ -140,7 +140,7 @@ int bench_futex_wake(int argc, const char **argv) sigaction(SIGINT, &act, NULL); if (!nthreads) - nthreads = ncpus; + nthreads = cpu->nr; worker = calloc(nthreads, sizeof(*worker)); if (!worker) -- 2.18.4

1 0

[PATCH openEuler-1.0-LTS] netfilter: nf_conntrack_irc: Tighten matching on DCC message
by Yongqiang Liu 13 Sep '22

13 Sep '22

From: David Leadbeater <dgl(a)dgl.cx> mainline inclusion from mainline-v6.0-rc6 commit e8d5dfd1d8747b56077d02664a8838c71ced948e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5OWZ7 CVE: CVE-2022-2663 --------------------------- CTCP messages should only be at the start of an IRC message, not anywhere within it. While the helper only decodes packes in the ORIGINAL direction, its possible to make a client send a CTCP message back by empedding one into a PING request. As-is, thats enough to make the helper believe that it saw a CTCP message. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") Signed-off-by: David Leadbeater <dgl(a)dgl.cx> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c index 4099f4d79bae..819fc0df233f 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -150,15 +150,37 @@ static int help(struct sk_buff *skb, unsigned int protoff, data = ib_ptr; data_limit = ib_ptr + skb->len - dataoff; - /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24 - * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ - while (data < data_limit - (19 + MINMATCHLEN)) { - if (memcmp(data, "\1DCC ", 5)) { + /* Skip any whitespace */ + while (data < data_limit - 10) { + if (*data == ' ' || *data == '\r' || *data == '\n') + data++; + else + break; + } + + /* strlen("PRIVMSG x ")=10 */ + if (data < data_limit - 10) { + if (strncasecmp("PRIVMSG ", data, 8)) + goto out; + data += 8; + } + + /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26 + * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26 + */ + while (data < data_limit - (21 + MINMATCHLEN)) { + /* Find first " :", the start of message */ + if (memcmp(data, " :", 2)) { data++; continue; } + data += 2; + + /* then check that place only for the DCC command */ + if (memcmp(data, "\1DCC ", 5)) + goto out; data += 5; - /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */ + /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */ iph = ip_hdr(skb); pr_debug("DCC found in master %pI4:%u %pI4:%u\n", @@ -174,7 +196,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, pr_debug("DCC %s detected\n", dccprotos[i]); /* we have at least - * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid + * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid * data left (== 14/13 bytes) */ if (parse_dcc(data, data_limit, &dcc_ip, &dcc_port, &addr_beg_p, &addr_end_p)) { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] selftests/bpf: Enlarge select() timeout for test_maps
by tangbin 13 Sep '22

13 Sep '22

From: Li Zhijian <lizhijian(a)cn.fujitsu.com> stable inclusion from stable-v4.19.207 commit 4c48bd3aa1a33cb3e8a0eca8330b8f100f43d895 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QR5E CVE: NA -------------------------------- commit 2d82d73da35b72b53fe0d96350a2b8d929d07e42 0Day robot observed that it's easily timeout on a heavy load host. ------------------- # selftests: bpf: test_maps # Fork 1024 tasks to 'test_update_delete' # Fork 1024 tasks to 'test_update_delete' # Fork 100 tasks to 'test_hashmap' # Fork 100 tasks to 'test_hashmap_percpu' # Fork 100 tasks to 'test_hashmap_sizes' # Fork 100 tasks to 'test_hashmap_walk' # Fork 100 tasks to 'test_arraymap' # Fork 100 tasks to 'test_arraymap_percpu' # Failed sockmap unexpected timeout not ok 3 selftests: bpf: test_maps # exit=1 # selftests: bpf: test_lru_map # nr_cpus:8 ------------------- Since this test will be scheduled by 0Day to a random host that could have only a few cpus(2-8), enlarge the timeout to avoid a false NG report. In practice, i tried to pin it to only one cpu by 'taskset 0x01 ./test_maps', and knew 10S is likely enough, but i still perfer to a larger value 30. Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Li Zhijian <lizhijian(a)cn.fujitsu.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Song Liu <songliubraving(a)fb.com> Link: https://lore.kernel.org/bpf/20210820015556.23276-2-lizhijian@cn.fujitsu.com Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- tools/testing/selftests/bpf/test_maps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c index 9b552c0fc47d..e5e62cb57ff7 100644 --- a/tools/testing/selftests/bpf/test_maps.c +++ b/tools/testing/selftests/bpf/test_maps.c @@ -796,7 +796,7 @@ static void test_sockmap(int tasks, void *data) FD_ZERO(&w); FD_SET(sfd[3], &w); - to.tv_sec = 1; + to.tv_sec = 30; to.tv_usec = 0; s = select(sfd[3] + 1, &w, NULL, NULL, &to); if (s == -1) { -- 2.18.4

1 0

[PATCH openEuler-5.10 1/3] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Zheng Zengkai 13 Sep '22

13 Sep '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> stable inclusion from stable-v5.10.137 commit 1a4b18b1ff11ba26f9a852019d674fde9d1d1cff category: bugfix bugzilla: 187457, https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 upstream. When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 560a93aad5b6..7b0497da2d94 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3638,6 +3638,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3648,6 +3649,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3668,7 +3670,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.20.1

1 2

[PATCH openEuler-22.09] Add openEuler header script for LoongArch
by Zheng Zengkai 13 Sep '22

13 Sep '22

Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- add-openeuler-head_loongarch.py | 39 +++++++++++++++++++ modify_message_loongarch.py | 62 ++++++++++++++++++++++++++++++ usage | 68 +++++++++++++++++++++++++++++++++ 3 files changed, 169 insertions(+) create mode 100755 add-openeuler-head_loongarch.py create mode 100755 modify_message_loongarch.py create mode 100644 usage diff --git a/add-openeuler-head_loongarch.py b/add-openeuler-head_loongarch.py new file mode 100755 index 000000000000..8219f6b6d8d2 --- /dev/null +++ b/add-openeuler-head_loongarch.py @@ -0,0 +1,39 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import textwrap + +dir = os.path.split(os.path.realpath(__file__))[0] + +def parser_arg(): + parser = argparse.ArgumentParser( + formatter_class=argparse.RawDescriptionHelpFormatter, + description=textwrap.dedent('''\ + Use git rebase to add header for commits on current branch + Note: + Make sure modify_message_loonarch.py be in the same dir + ''')) + + parser.add_argument('-n', type=str, default="", help='add head to last n patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +def main(): + args = parser_arg() + + if args.n == "": + args.n = os.popen("git log --oneline origin/openEuler-22.09..HEAD | wc -l").readline().strip("\n") + + command ="git rebase --onto HEAD~" + args.n + " HEAD~" + args.n + " --exec \"" + command += dir + "/modify_message_loongarch.py " + command += " --bugzilla " + args.bugzilla + " " + command += "\"" + print(command) + os.system(command) + +if __name__ == "__main__": + # execute only if run as a script + main() + diff --git a/modify_message_loongarch.py b/modify_message_loongarch.py new file mode 100755 index 000000000000..6853178794f7 --- /dev/null +++ b/modify_message_loongarch.py @@ -0,0 +1,62 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import re + +def parser_arg(): + parser = argparse.ArgumentParser(description='add head to last patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +args = parser_arg() + +def add_head_loongarch(title): + head = [ + "LoongArch inclusion\n", + "category: feature\n", + "bugzilla: " + args.bugzilla + "\n", + "\n", + "--------------------------------\n", + "\n", + ] + return head + +def add_head(): + MSG = ".git/TEMP_COMMIT_MSG" + message = os.popen("git log -n 1 --pretty=%B").readlines() + find = 0 + + title = message[0].strip("\n"); + + # there is areadly a head + if title[0] == "[": + return + + if find == 0: + head = add_head_loongarch(title) + if head: + find = 1 + + if message[1] == "\t\n": + post = 1; + else: + post = 2; + + message[post:post] = head + + f = open(MSG, 'w') + for line in message: + f.write(line) + f.close() + + os.system("git commit --amend -F " + MSG) + +def main(): + add_head() + return 0 + +if __name__ == "__main__": + # execute only if run as a script + main() diff --git a/usage b/usage new file mode 100644 index 000000000000..97c9bd7e05da --- /dev/null +++ b/usage @@ -0,0 +1,68 @@ +Usage: +./add-openeuler-head_loongarch.py -n=2 --bugzilla=https://gitee.com/openeuler/kernel/issues/I5OHOB + +-n to specify the number of patches to add header to. + +before adding header: + +commit f0f6daca3f4677e3aa2817e204e2281d0d999614 +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 6c3213c6068534e84e65cf1f2aff0ed18810cc4b +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +After adding header: + +commit 94e56df31f6c6b8177687b7f7db6362d62183cd5 (HEAD -> openEuler-22.09) +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 7e7e79233dce5cef575c35ab40b67982919eb1ca +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> -- 2.20.1

1 0

[PATCH openEuler-22.09 0/6] tools/bpftool: Add BTF_KIND_FLOAT support
by Zheng Zengkai 08 Sep '22

08 Sep '22

Some BPF programs compiled on s390 fail to load, because s390 arch-specific linux headers contain float and double types. Introduce support for such types by representing them using the new BTF_KIND_FLOAT. This series deals with libbpf, bpftool, in-kernel BTF parser as well as selftests and documentation. Ilya Leoshkevich (6): tools/bpftool: Add BTF_KIND_FLOAT support selftests/bpf: Use the 25th bit in the "invalid BTF_INFO" test bpf: Add BTF_KIND_FLOAT support selftest/bpf: Add BTF_KIND_FLOAT tests selftests/bpf: Add BTF_KIND_FLOAT to the existing deduplication tests bpf: Document BTF_KIND_FLOAT in btf.rst Documentation/bpf/btf.rst | 17 +- kernel/bpf/btf.c | 83 ++++++++- tools/bpf/bpftool/btf.c | 8 + tools/bpf/bpftool/btf_dumper.c | 1 + tools/testing/selftests/bpf/btf_helpers.c | 4 + tools/testing/selftests/bpf/prog_tests/btf.c | 176 +++++++++++++++++-- tools/testing/selftests/bpf/test_btf.h | 3 + 7 files changed, 275 insertions(+), 17 deletions(-) -- 2.20.1

1 6

[OLK-5.10,0/3] Fix CVE-2022-2586
by Lu Wei 07 Sep '22

07 Sep '22

Thadeu Lima de Souza Cascardo (3): netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain net/netfilter/nf_tables_api.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) -- 2.31.1

1 3

[PATCH openEuler-5.10-LTS 1/3] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Zheng Zengkai 07 Sep '22

07 Sep '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 560a93aad5b6..7b0497da2d94 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3638,6 +3638,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3648,6 +3649,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3668,7 +3670,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.20.1

1 2

[PATCH openEuler-1.0-LTS 00/64] linux-4.19.y inclusion
by Yongqiang Liu 07 Sep '22

07 Sep '22

*** BLURB HERE *** Chen Zhongjin (2): profiling: fix shift too large makes kernel panic kprobes: Forbid probing on trampoline and BPF code areas Dan Carpenter (1): kfifo: fix kfifo_to_user() return type David Howells (1): vfs: Check the truncate maximum size in inode_newsize_ok() Duoming Zhou (1): mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release Eric Dumazet (1): tcp: fix over estimation in sk_forced_mem_schedule() Eric Whitney (1): ext4: fix extent status tree race in writeback error recovery path Hector Martin (1): locking/atomic: Make test_and_*_bit() ordered on failure Ilpo Järvinen (1): serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() Jason A. Donenfeld (1): fs: check FMODE_LSEEK to control internal pipe splicing Johan Hovold (1): x86/pmem: Fix platform-device leak in error path Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Kuniyuki Iwashima (36): ip: Fix data-races around sysctl_ip_fwd_use_pmtu. ip: Fix data-races around sysctl_ip_nonlocal_bind. ip: Fix a data-race around sysctl_fwmark_reflect. tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. tcp: Fix data-races around sysctl_tcp_mtu_probing. tcp: Fix a data-race around sysctl_tcp_probe_threshold. tcp: Fix a data-race around sysctl_tcp_probe_interval. igmp: Fix data-races around sysctl_igmp_llm_reports. igmp: Fix a data-race around sysctl_igmp_max_memberships. tcp: Fix data-races around sysctl_tcp_reordering. tcp: Fix data-races around some timeout sysctl knobs. tcp: Fix a data-race around sysctl_tcp_notsent_lowat. tcp: Fix a data-race around sysctl_tcp_tw_reuse. tcp: Fix data-races around sysctl_tcp_fastopen. tcp: Fix a data-race around sysctl_tcp_early_retrans. tcp: Fix data-races around sysctl_tcp_recovery. tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. tcp: Fix a data-race around sysctl_tcp_retrans_collapse. tcp: Fix a data-race around sysctl_tcp_stdurg. tcp: Fix a data-race around sysctl_tcp_rfc1337. tcp: Fix data-races around sysctl_tcp_max_reordering. tcp: Fix data-races around sysctl_tcp_dsack. tcp: Fix a data-race around sysctl_tcp_app_win. tcp: Fix a data-race around sysctl_tcp_adv_win_scale. tcp: Fix a data-race around sysctl_tcp_frto. tcp: Fix a data-race around sysctl_tcp_nometrics_save. tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. net: ping6: Fix memleak in ipv6_renew_options(). igmp: Fix data-races around sysctl_igmp_qrv. tcp: Fix a data-race around sysctl_tcp_min_tso_segs. tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. tcp: Fix a data-race around sysctl_tcp_autocorking. tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. Lukas Czerner (1): ext4: make sure ext4_append() always allocates new block Matthias May (1): geneve: do not use RT_TOS for IPv6 flowlabel Miaohe Lin (1): mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region Nicolas Saenz Julienne (1): nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() Theodore Ts'o (1): ext4: update s_overhead_clusters in the superblock during an on-line resize Trond Myklebust (2): NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Uwe Kleine-König (1): mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path Vincent Mailhol (1): can: error: specify the values of data[5..7] of CAN error frames Wang Cheng (1): mm/mempolicy: fix uninit-value in mpol_rebind_policy() Xiu Jianfeng (1): selinux: Add boundary check in put_entry() Yang Xu (1): fs: Add missing umask strip in vfs_tmpfile Yang Yingliang (1): bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() Yonglong Li (1): tcp: make retransmitted SKB fit into the send window Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES huhai (1): ACPI: LPSS: Fix missing check in register_device_clock() Documentation/atomic_bitops.txt | 2 +- arch/x86/kernel/pmem.c | 7 ++++- drivers/acpi/acpi_lpss.c | 3 ++ drivers/bus/hisi_lpc.c | 10 +++--- drivers/mtd/devices/st_spi_fsm.c | 8 +++-- drivers/mtd/sm_ftl.c | 2 +- drivers/net/geneve.c | 3 +- drivers/tty/serial/8250/8250_dw.c | 3 ++ fs/attr.c | 2 ++ fs/ext4/inode.c | 7 +++++ fs/ext4/namei.c | 16 ++++++++++ fs/ext4/resize.c | 11 +++++++ fs/namei.c | 2 ++ fs/nfs/nfs4proc.c | 14 ++++++--- fs/splice.c | 10 +++--- include/asm-generic/bitops/atomic.h | 6 ---- include/linux/kfifo.h | 2 +- include/net/inet_sock.h | 5 +-- include/net/ip.h | 4 +-- include/net/tcp.h | 11 ++++--- include/uapi/linux/can/error.h | 5 ++- kernel/kprobes.c | 3 +- kernel/profile.c | 7 +++++ kernel/sched/rt.c | 15 +++++---- mm/mempolicy.c | 2 +- mm/mmap.c | 1 - net/ipv4/af_inet.c | 2 +- net/ipv4/igmp.c | 47 +++++++++++++++++------------ net/ipv4/route.c | 2 +- net/ipv4/tcp.c | 12 +++++--- net/ipv4/tcp_fastopen.c | 4 +-- net/ipv4/tcp_input.c | 39 ++++++++++++++---------- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_metrics.c | 5 +-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 46 +++++++++++++++++----------- net/ipv4/tcp_recovery.c | 6 ++-- net/ipv4/tcp_timer.c | 14 ++++----- net/ipv6/ping.c | 6 ++++ net/sctp/protocol.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 +++++++++ security/selinux/ss/policydb.h | 2 ++ 42 files changed, 240 insertions(+), 126 deletions(-) -- 2.25.1

1 64

2024

2023

2022

2021

2020

2019

Kernel