- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
by Peng Zhang 26 Oct '23

26 Oct '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.4-rc3 commit 280a8ab81733da8bc442253c700a52c4c0886ffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3C CVE: CVE-2022-45919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index fd476536d32e..a8b4247cb5e4 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -151,6 +151,12 @@ struct dvb_ca_private { /* mutex serializing ioctls */ struct mutex ioctl_mutex; + + /* A mutex used when a device is disconnected */ + struct mutex remove_mutex; + + /* Whether the device is disconnected */ + int exit; }; static void dvb_ca_private_free(struct dvb_ca_private *ca) @@ -1706,12 +1712,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dprintk("%s\n", __func__); - if (!try_module_get(ca->pub->owner)) + mutex_lock(&ca->remove_mutex); + + if (ca->exit) { + mutex_unlock(&ca->remove_mutex); + return -ENODEV; + } + + if (!try_module_get(ca->pub->owner)) { + mutex_unlock(&ca->remove_mutex); return -EIO; + } err = dvb_generic_open(inode, file); if (err < 0) { module_put(ca->pub->owner); + mutex_unlock(&ca->remove_mutex); return err; } @@ -1736,6 +1752,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dvb_ca_private_get(ca); + mutex_unlock(&ca->remove_mutex); return 0; } @@ -1755,6 +1772,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + /* mark the CA device as closed */ ca->open = 0; dvb_ca_en50221_thread_update_delay(ca); @@ -1765,6 +1784,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dvb_ca_private_put(ca); + if (dvbdev->users == 1 && ca->exit == 1) { + mutex_unlock(&ca->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&ca->remove_mutex); + } + return err; } @@ -1888,6 +1914,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, } mutex_init(&ca->ioctl_mutex); + mutex_init(&ca->remove_mutex); if (signal_pending(current)) { ret = -EINTR; @@ -1930,6 +1957,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + ca->exit = 1; + mutex_unlock(&ca->remove_mutex); + + if (ca->dvbdev->users < 1) + wait_event(ca->dvbdev->wait_queue, + ca->dvbdev->users == 1); + /* shutdown the thread if there was one */ kthread_stop(ca->thread); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/3] Fix cgroup psi poll UAF
by Lu Jialin 26 Oct '23

26 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] xen/events: replace evtchn_rwlock with RCU
by Liu Shixin 26 Oct '23

26 Oct '23

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v5.10.198 commit 660627c71bc1098aa94e5f208f14748b105b73bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I896EC CVE: CVE-2023-34324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 87797fad6cce28ec9be3c13f031776ff4f104cfc upstream. In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. Normally this is no problem, as the evtchn_rwlock is taken as a reader in both paths, but as soon as an event channel is being closed, the lock will be taken as a writer, which will cause read_lock() to block: CPU0 CPU1 CPU2 (IRQ handling) (__hvc_poll()) (closing event channel) read_lock(evtchn_rwlock) spin_lock(hvc_lock) write_lock(evtchn_rwlock) [blocks] spin_lock(hvc_lock) [blocks] read_lock(evtchn_rwlock) [blocks due to writer waiting, and not in_interrupt()] This issue can be avoided by replacing evtchn_rwlock with RCU in xen_free_irq(). Note that RCU is used only to delay freeing of the irq_info memory. There is no RCU based dereferencing or replacement of pointers involved. In order to avoid potential races between removing the irq_info reference and handling of interrupts, set the irq_info pointer to NULL only when freeing its memory. The IRQ itself must be freed at that time, too, as otherwise the same IRQ number could be allocated again before handling of the old instance would have been finished. This is XSA-441 / CVE-2023-34324. Fixes: 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Julien Grall <jgrall(a)amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/xen/events/events_base.c | 87 +++++++++++++++++--------------- 1 file changed, 46 insertions(+), 41 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index fba78daee449a..52891546e6973 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -33,6 +33,7 @@ #include <linux/slab.h> #include <linux/irqnr.h> #include <linux/pci.h> +#include <linux/rcupdate.h> #include <linux/spinlock.h> #include <linux/cpuhotplug.h> #include <linux/atomic.h> @@ -94,6 +95,7 @@ enum xen_irq_type { struct irq_info { struct list_head list; struct list_head eoi_list; + struct rcu_work rwork; short refcnt; short spurious_cnt; short type; /* type */ @@ -141,23 +143,13 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); -/* - * Lock protecting event handling loop against removing event channels. - * Adding of event channels is no issue as the associated IRQ becomes active - * only after everything is setup (before request_[threaded_]irq() the handler - * can't be entered for an event, as the event channel will be unmasked only - * then). - */ -static DEFINE_RWLOCK(evtchn_rwlock); - /* * Lock hierarchy: * * irq_mapping_update_lock - * evtchn_rwlock - * IRQ-desc lock - * percpu eoi_list_lock - * irq_info->lock + * IRQ-desc lock + * percpu eoi_list_lock + * irq_info->lock */ static LIST_HEAD(xen_irq_list_head); @@ -272,6 +264,22 @@ static void set_info_for_irq(unsigned int irq, struct irq_info *info) irq_set_chip_data(irq, info); } +static void delayed_free_irq(struct work_struct *work) +{ + struct irq_info *info = container_of(to_rcu_work(work), struct irq_info, + rwork); + unsigned int irq = info->irq; + + /* Remove the info pointer only now, with no potential users left. */ + set_info_for_irq(irq, NULL); + + kfree(info); + + /* Legacy IRQ descriptors are managed by the arch. */ + if (irq >= nr_legacy_irqs()) + irq_free_desc(irq); +} + /* Constructors for packed IRQ information. */ static int xen_irq_info_common_setup(struct irq_info *info, unsigned irq, @@ -606,33 +614,36 @@ static void xen_irq_lateeoi_worker(struct work_struct *work) eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed); - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); while (true) { - spin_lock(&eoi->eoi_list_lock); + spin_lock_irqsave(&eoi->eoi_list_lock, flags); info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info, eoi_list); - if (info == NULL || now < info->eoi_time) { - spin_unlock(&eoi->eoi_list_lock); + if (info == NULL) + break; + + if (now < info->eoi_time) { + mod_delayed_work_on(info->eoi_cpu, system_wq, + &eoi->delayed, + info->eoi_time - now); break; } list_del_init(&info->eoi_list); - spin_unlock(&eoi->eoi_list_lock); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); info->eoi_time = 0; xen_irq_lateeoi_locked(info, false); } - if (info) - mod_delayed_work_on(info->eoi_cpu, system_wq, - &eoi->delayed, info->eoi_time - now); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } static void xen_cpu_init_eoi(unsigned int cpu) @@ -647,16 +658,15 @@ static void xen_cpu_init_eoi(unsigned int cpu) void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags) { struct irq_info *info; - unsigned long flags; - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); info = info_for_irq(irq); if (info) xen_irq_lateeoi_locked(info, eoi_flags & XEN_EOI_FLAG_SPURIOUS); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } EXPORT_SYMBOL_GPL(xen_irq_lateeoi); @@ -675,6 +685,7 @@ static void xen_irq_init(unsigned irq) info->type = IRQT_UNBOUND; info->refcnt = -1; + INIT_RCU_WORK(&info->rwork, delayed_free_irq); set_info_for_irq(irq, info); @@ -727,31 +738,18 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = info_for_irq(irq); - unsigned long flags; if (WARN_ON(!info)) return; - write_lock_irqsave(&evtchn_rwlock, flags); - if (!list_empty(&info->eoi_list)) lateeoi_list_del(info); list_del(&info->list); - set_info_for_irq(irq, NULL); - WARN_ON(info->refcnt > 0); - write_unlock_irqrestore(&evtchn_rwlock, flags); - - kfree(info); - - /* Legacy IRQ descriptors are managed by the arch. */ - if (irq < nr_legacy_irqs()) - return; - - irq_free_desc(irq); + queue_rcu_work(system_wq, &info->rwork); } static void xen_evtchn_close(evtchn_port_t port) @@ -1639,7 +1637,14 @@ static void __xen_evtchn_do_upcall(void) int cpu = smp_processor_id(); struct evtchn_loop_ctrl ctrl = { 0 }; - read_lock(&evtchn_rwlock); + /* + * When closing an event channel the associated IRQ must not be freed + * until all cpus have left the event handling loop. This is ensured + * by taking the rcu_read_lock() while handling events, as freeing of + * the IRQ is handled via queue_rcu_work() _after_ closing the event + * channel. + */ + rcu_read_lock(); do { vcpu_info->evtchn_upcall_pending = 0; @@ -1652,7 +1657,7 @@ static void __xen_evtchn_do_upcall(void) } while (vcpu_info->evtchn_upcall_pending); - read_unlock(&evtchn_rwlock); + rcu_read_unlock(); /* * Increment irq_epoch only now to defer EOIs only for -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] Fix cgroup poll UAF
by Lu Jialin 26 Oct '23

26 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] integrity: Fix possible multiple allocation in integrity_inode_get()
by felix 26 Oct '23

26 Oct '23

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> mainline inclusion from mainline-v6.5-rc1 commit 9df6a4870dc371136e90330cfbbc51464ee66993 category: bugfix bugzilla: 189204 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When integrity_inode_get() is querying and inserting the cache, there is a conditional race in the concurrent environment. The race condition is the result of not properly implementing "double-checked locking". In this case, it first checks to see if the iint cache record exists before taking the lock, but doesn't check again after taking the integrity_iint_lock. Fixes: bf2276d10ce5 ("ima: allocating iint improvements") Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Cc: Dmitry Kasatkin <dmitry.kasatkin(a)gmail.com> Cc: <stable(a)vger.kernel.org> # v3.10+ Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: felix <fuzhen5(a)huawei.com> --- security/integrity/iint.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 1668cfbeb671..2428037d9e14 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) else if (inode > iint->inode) n = n->rb_right; else - break; + return iint; } - if (!n) - return NULL; - return iint; + return NULL; } /* @@ -111,10 +109,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) parent = *p; test_iint = rb_entry(parent, struct integrity_iint_cache, rb_node); - if (inode < test_iint->inode) + if (inode < test_iint->inode) { p = &(*p)->rb_left; - else + } else if (inode > test_iint->inode) { p = &(*p)->rb_right; + } else { + write_unlock(&integrity_iint_lock); + kmem_cache_free(iint_cache, iint); + return test_iint; + } } iint->inode = inode; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/3] fix cgroup poll UAF
by Lu Jialin 25 Oct '23

25 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/4] ACPI for MPAM 2.0
by Yu Liao 25 Oct '23

25 Oct '23

Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 21 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 7 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS 0/2] support CPU turbo for
by Yu Liao 25 Oct '23

25 Oct '23

Xiongfeng Wang (2): cpufreq: change '.set_boost' to act on one policy cpufreq: CPPC: add SW BOOST support drivers/cpufreq/acpi-cpufreq.c | 14 ++++---- drivers/cpufreq/cppc_cpufreq.c | 35 ++++++++++++++++++-- drivers/cpufreq/cpufreq.c | 58 +++++++++++++++++++--------------- include/linux/cpufreq.h | 2 +- 4 files changed, 75 insertions(+), 34 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 v2 0/8] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 25 Oct '23

25 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures 4. acpi: Ignore the absence of graph coresight: platform: acpi: Ignore the absence of graph Revert "coresight: Return the pointer of @pdata when not "fwnode"" Junhao He (3): Revert "coresight: Return the pointer of @pdata when not "fwnode"" coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (3): coresight: trbe: Allocate platform data per device coresight: platform: acpi: Ignore the absence of graph coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 56 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 ++++---- drivers/hwtracing/coresight/coresight-trbe.c | 42 +++++++------- 3 files changed, 70 insertions(+), 51 deletions(-) -- 2.33.0

2 9

[PATCH OLK-5.10 0/7] add sample sockmap code for redis
by Liu Jian 25 Oct '23

25 Oct '23

Hengqi Chen (1): libbpf: Support uniform BTF-defined key/value specification across all BPF maps Liu Jian (4): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted net: let sockops can use bpf_get_current_comm() net: add local_skb parameter to identify local tcp connection tools: add sample sockmap code for redis Xu Kuohai (1): bpf, sockmap: Fix map type error in sock_map_del_link Yosry Ahmed (1): cgroup: add cgroup_v1v2_get_from_[fd/file]() include/linux/cgroup.h | 2 + include/linux/filter.h | 1 + include/linux/skbuff.h | 3 + include/uapi/linux/bpf.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 73 +++++++- net/core/filter.c | 9 + net/core/sock_map.c | 10 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_output.c | 5 + tools/include/uapi/linux/bpf.h | 1 + tools/lib/bpf/libbpf.c | 24 +++ tools/netacc/Makefile | 24 +++ tools/netacc/bpf_sockmap.h | 167 +++++++++++++++++++ tools/netacc/net-acc | 35 ++++ tools/netacc/netacc.c | 294 +++++++++++++++++++++++++++++++++ tools/netacc/netaccsockmap.c | 176 ++++++++++++++++++++ 17 files changed, 822 insertions(+), 15 deletions(-) create mode 100644 tools/netacc/Makefile create mode 100644 tools/netacc/bpf_sockmap.h create mode 100755 tools/netacc/net-acc create mode 100644 tools/netacc/netacc.c create mode 100644 tools/netacc/netaccsockmap.c -- 2.34.1

2 8

2024

2023

2022

2021

2020

2019

Kernel