- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52502 for openEuler-1.0-LTS
by Liu Jian 12 Mar '24

12 Mar '24

CVE-2023-52502 Eric Dumazet (1): net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Krzysztof Kozlowski (1): nfc: constify several pointers to u8, char and sk_buff include/net/nfc/nfc.h | 4 +-- net/nfc/core.c | 4 +-- net/nfc/hci/llc_shdlc.c | 10 +++--- net/nfc/llcp.h | 8 ++--- net/nfc/llcp_commands.c | 46 ++++++++++++++------------ net/nfc/llcp_core.c | 72 ++++++++++++++++++++--------------------- net/nfc/nfc.h | 2 +- 7 files changed, 74 insertions(+), 72 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
by Liu Jian 12 Mar '24

12 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.199 commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP CVE: CVE-2023-52502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ] Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Fixes: 8f50020ed9b8 ("NFC: LLCP late binding") Reported-by: Sili Luo <rootlab(a)huawei.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willy Tarreau <w(a)1wt.eu> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/llcp_core.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index ddfd159f64e1..f2a2454ed07d 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) { llcp_sock = tmp_sock; + sock_hold(&llcp_sock->sk); break; } } read_unlock(&local->sockets.lock); - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - return llcp_sock; } @@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len) static struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, - const u8 *sn, size_t sn_len) + const u8 *sn, size_t sn_len, + bool needref) { struct sock *sk; struct nfc_llcp_sock *llcp_sock, *tmp_sock; @@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) { llcp_sock = tmp_sock; + if (needref) + sock_hold(&llcp_sock->sk); break; } } @@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, * to this service name. */ if (nfc_llcp_sock_from_sn(local, sock->service_name, - sock->service_name_len) != NULL) { + sock->service_name_len, + false) != NULL) { mutex_unlock(&local->sdp_lock); return LLCP_SAP_MAX; @@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, const u8 *sn, size_t sn_len) { - struct nfc_llcp_sock *llcp_sock; - - llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len); - - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - - return llcp_sock; + return nfc_llcp_sock_from_sn(local, sn, sn_len, true); } static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len) @@ -1307,7 +1298,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, } llcp_sock = nfc_llcp_sock_from_sn(local, service_name, - service_name_len); + service_name_len, + true); if (!llcp_sock) { sap = 0; goto add_snl; @@ -1327,6 +1319,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, if (sap == LLCP_SAP_MAX) { sap = 0; + nfc_llcp_sock_put(llcp_sock); goto add_snl; } @@ -1344,6 +1337,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, pr_debug("%p %d\n", llcp_sock, sap); + nfc_llcp_sock_put(llcp_sock); add_snl: sdp = nfc_llcp_build_sdres_tlv(tid, sap); if (sdp == NULL) -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] *** SUBJECT HERE ***
by Zhou Shuai 12 Mar '24

12 Mar '24

*** BLURB HERE *** Zhou Shuai (1): net/hinic: Sync hinic driver with OLK-5.10 drivers/net/ethernet/huawei/hinic/Makefile | 14 +- .../net/ethernet/huawei/hinic/hinic_api_cmd.c | 1164 ++++ .../net/ethernet/huawei/hinic/hinic_api_cmd.h | 298 + drivers/net/ethernet/huawei/hinic/hinic_cfg.c | 2478 ++++++++ drivers/net/ethernet/huawei/hinic/hinic_cfg.h | 526 ++ .../net/ethernet/huawei/hinic/hinic_cmdq.c | 1575 ++++++ .../net/ethernet/huawei/hinic/hinic_cmdq.h | 217 + .../net/ethernet/huawei/hinic/hinic_common.c | 71 - .../net/ethernet/huawei/hinic/hinic_common.h | 29 - drivers/net/ethernet/huawei/hinic/hinic_csr.h | 207 + .../net/ethernet/huawei/hinic/hinic_ctx_def.h | 242 + drivers/net/ethernet/huawei/hinic/hinic_dbg.h | 93 + .../ethernet/huawei/hinic/hinic_dbgtool_knl.c | 899 +++ .../ethernet/huawei/hinic/hinic_dbgtool_knl.h | 120 + drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 1795 ++++++ drivers/net/ethernet/huawei/hinic/hinic_dcb.h | 67 + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 324 -- .../net/ethernet/huawei/hinic/hinic_debugfs.h | 113 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 132 - .../net/ethernet/huawei/hinic/hinic_devlink.c | 584 -- .../net/ethernet/huawei/hinic/hinic_devlink.h | 119 - .../net/ethernet/huawei/hinic/hinic_dfx_def.h | 150 + drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 1462 +++++ drivers/net/ethernet/huawei/hinic/hinic_eqs.h | 177 + .../net/ethernet/huawei/hinic/hinic_ethtool.c | 3078 ++++++---- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 770 +++ .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 987 ---- .../ethernet/huawei/hinic/hinic_hw_api_cmd.h | 203 - .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 963 ---- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.h | 185 - .../net/ethernet/huawei/hinic/hinic_hw_csr.h | 139 - .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 1197 ---- .../net/ethernet/huawei/hinic/hinic_hw_dev.h | 660 --- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 996 ---- .../net/ethernet/huawei/hinic/hinic_hw_eqs.h | 262 - .../net/ethernet/huawei/hinic/hinic_hw_if.c | 419 -- .../net/ethernet/huawei/hinic/hinic_hw_if.h | 295 - .../net/ethernet/huawei/hinic/hinic_hw_io.c | 634 --- .../net/ethernet/huawei/hinic/hinic_hw_io.h | 123 - .../net/ethernet/huawei/hinic/hinic_hw_mbox.h | 172 - .../net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 681 --- .../net/ethernet/huawei/hinic/hinic_hw_mgmt.h | 636 ++- .../net/ethernet/huawei/hinic/hinic_hw_qp.c | 971 ---- .../net/ethernet/huawei/hinic/hinic_hw_qp.h | 232 - .../ethernet/huawei/hinic/hinic_hw_qp_ctxt.h | 210 - .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 904 --- .../net/ethernet/huawei/hinic/hinic_hw_wq.h | 111 - .../net/ethernet/huawei/hinic/hinic_hw_wqe.h | 430 -- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 5001 +++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_hwdev.h | 370 ++ .../net/ethernet/huawei/hinic/hinic_hwif.c | 1005 ++++ .../net/ethernet/huawei/hinic/hinic_hwif.h | 123 + drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2923 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.h | 128 + .../net/ethernet/huawei/hinic/hinic_main.c | 3848 +++++++++---- .../hinic/{hinic_hw_mbox.c => hinic_mbox.c} | 1267 +++-- .../net/ethernet/huawei/hinic/hinic_mbox.h | 241 + .../net/ethernet/huawei/hinic/hinic_mgmt.c | 1446 +++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 245 + .../huawei/hinic/hinic_mgmt_interface.h | 987 ++++ .../ethernet/huawei/hinic/hinic_msix_attr.c | 130 + .../ethernet/huawei/hinic/hinic_msix_attr.h | 69 + .../huawei/hinic/hinic_multi_host_mgmt.c | 972 ++++ .../huawei/hinic/hinic_multi_host_mgmt.h | 107 + drivers/net/ethernet/huawei/hinic/hinic_nic.h | 115 + .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 3996 +++++++++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 638 +++ .../net/ethernet/huawei/hinic/hinic_nic_dbg.c | 294 + .../net/ethernet/huawei/hinic/hinic_nic_dev.h | 289 + .../net/ethernet/huawei/hinic/hinic_nic_io.c | 1047 ++++ .../net/ethernet/huawei/hinic/hinic_nic_io.h | 99 + .../net/ethernet/huawei/hinic/hinic_nictool.c | 2503 +++++++++ .../net/ethernet/huawei/hinic/hinic_nictool.h | 277 + .../ethernet/huawei/hinic/hinic_pci_id_tbl.h | 40 + .../net/ethernet/huawei/hinic/hinic_port.c | 1412 ----- .../net/ethernet/huawei/hinic/hinic_port.h | 900 --- .../ethernet/huawei/hinic/hinic_port_cmd.h | 541 ++ .../net/ethernet/huawei/hinic/hinic_qe_def.h | 459 ++ drivers/net/ethernet/huawei/hinic/hinic_qp.c | 222 + drivers/net/ethernet/huawei/hinic/hinic_qp.h | 143 + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 1342 +++-- drivers/net/ethernet/huawei/hinic/hinic_rx.h | 126 +- .../net/ethernet/huawei/hinic/hinic_sm_lt.h | 228 + .../ethernet/huawei/hinic/hinic_sml_counter.c | 310 + .../ethernet/huawei/hinic/hinic_sml_counter.h | 119 + .../net/ethernet/huawei/hinic/hinic_sml_lt.c | 286 + .../net/ethernet/huawei/hinic/hinic_sriov.c | 1535 ++--- .../net/ethernet/huawei/hinic/hinic_sriov.h | 98 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 1426 +++-- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 127 +- drivers/net/ethernet/huawei/hinic/hinic_wq.c | 683 +++ drivers/net/ethernet/huawei/hinic/hinic_wq.h | 117 + drivers/net/ethernet/huawei/hinic/ossl_knl.h | 63 + 93 files changed, 46543 insertions(+), 19868 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_ctx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dfx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_csr.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp_ctxt.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wqe.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.h rename drivers/net/ethernet/huawei/hinic/{hinic_hw_mbox.c => hinic_mbox.c} (58%) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_pci_id_tbl.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qe_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic/ossl_knl.h -- 2.24.0

2 2

[PATCH OLK-6.6 00/15] KVM: arm64: Enable 'writable' ID registers
by chenxiang 12 Mar '24

12 Mar '24

From: caijian <caijian11(a)h-partners.com> Backport the code of enabling 'writable' ID registers from mainline to openEuler 6.6. It is the fundation of live migration between different platforms. Marc Zyngier (15): KVM: arm64: vgic-v3: Upgrade AP1Rn to 64bit. KVM: arm64: vgic-v3: Allow the NMI state to make it into the LRs KVM: arm64: vgic-v3: Make NMI priority RES0 KVM: arm64: vgic-v4: Propagate the NMI state into the GICv4.1 VSGI configuration KVM: arm64: vgic-v3: Use the NMI attribute as part of the AP-list sorting KVM: arm64: vgic-v3: Add support for GIC{D,R}_INMIR registers KVM: arm64: vgic-v3: Add userspace selection for GICv3.3 NMI KVM: arm64: vgic-debug: Add the NMI field to the debug output KVM: arm64: Allow userspace to control ID_AA64PFR1_EL1.NMI KVM: arm64: Don't trap ALLINT accesses if the vcpu has FEAT_NMI KVM: arm64: vgic-v3: Don't inject an NMI if the vcpu doesn't have FEAT_NMI KVM: arm64: Allow GICv3.3 NMI if the host supports it KVM: arm64: Handle traps of ALLINT arm64: Decouple KVM from CONFIG_ARM64_NMI KVM: arm64: vgic-v3: Handle traps of ICV_NMIAR1_EL1 arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/asm/sysreg.h | 3 ++ arch/arm64/kernel/cpufeature.c | 15 +++--- arch/arm64/kvm/arm.c | 3 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 6 ++- arch/arm64/kvm/hyp/vgic-v3-sr.c | 14 +++-- arch/arm64/kvm/sys_regs.c | 33 +++++++++++- arch/arm64/kvm/vgic/vgic-debug.c | 9 ++-- arch/arm64/kvm/vgic/vgic-init.c | 10 +++- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 1 + arch/arm64/kvm/vgic/vgic-mmio-v3.c | 70 ++++++++++++++++++++++++- arch/arm64/kvm/vgic/vgic-mmio.c | 25 ++++++--- arch/arm64/kvm/vgic/vgic-v3.c | 12 ++++- arch/arm64/kvm/vgic/vgic-v4.c | 1 + arch/arm64/kvm/vgic/vgic.c | 8 ++- arch/arm64/kvm/vgic/vgic.h | 1 + drivers/irqchip/irq-gic-v3-its.c | 9 ++++ drivers/irqchip/irq-gic-v3.c | 12 +++++ drivers/irqchip/irq-gic-v4.c | 3 +- include/kvm/arm_vgic.h | 10 +++- include/linux/irqchip/arm-gic-v4.h | 4 +- include/linux/irqchip/arm-vgic-info.h | 2 + 23 files changed, 224 insertions(+), 32 deletions(-) -- 2.30.0

2 12

[PATCH OLK-6.6 0/6] Adding Huawei BMA driver
by Zheng Zengkai 12 Mar '24

12 Mar '24

From: Huajingjing <huajingjing1(a)huawei.com> This patch set contains 5 communication drivers for Huawei BMA software. The BMA software is a system management software. It supports the status monitoring, performance monitoring, and event monitoring of various components, including server CPUs, memory, hard disks, NICs, IB cards, PCIe cards, RAID controller cards, and optical modules. These 5 drivers are used to send/receive message through PCIe channel in different ways by BMA software. Huajingjing (6): Huawei BMA: Adding Huawei BMA driver: host_edma_drv Huawei BMA: Adding Huawei BMA driver: host_cdev_drv Huawei BMA: Adding Huawei BMA driver: host_veth_drv Huawei BMA: Adding Huawei BMA driver: host_kbox_drv Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv configs: add config BMA to config files arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/bma/Kconfig | 10 + drivers/net/ethernet/huawei/bma/Makefile | 9 + .../net/ethernet/huawei/bma/cdev_drv/Makefile | 2 + .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 369 +++ .../huawei/bma/cdev_veth_drv/Makefile | 2 + .../bma/cdev_veth_drv/virtual_cdev_eth_net.c | 1864 ++++++++++++ .../bma/cdev_veth_drv/virtual_cdev_eth_net.h | 299 ++ .../net/ethernet/huawei/bma/edma_drv/Makefile | 2 + .../huawei/bma/edma_drv/bma_devintf.c | 621 ++++ .../huawei/bma/edma_drv/bma_devintf.h | 40 + .../huawei/bma/edma_drv/bma_include.h | 116 + .../ethernet/huawei/bma/edma_drv/bma_pci.c | 533 ++++ .../ethernet/huawei/bma/edma_drv/bma_pci.h | 98 + .../ethernet/huawei/bma/edma_drv/edma_host.c | 1462 ++++++++++ .../ethernet/huawei/bma/edma_drv/edma_host.h | 351 +++ .../huawei/bma/include/bma_ker_intf.h | 94 + .../net/ethernet/huawei/bma/kbox_drv/Makefile | 5 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.c | 121 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.h | 33 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.c | 102 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.h | 33 + .../huawei/bma/kbox_drv/kbox_include.h | 40 + .../ethernet/huawei/bma/kbox_drv/kbox_main.c | 176 ++ .../ethernet/huawei/bma/kbox_drv/kbox_main.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_mce.c | 264 ++ .../ethernet/huawei/bma/kbox_drv/kbox_mce.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_panic.c | 187 ++ .../ethernet/huawei/bma/kbox_drv/kbox_panic.h | 25 + .../huawei/bma/kbox_drv/kbox_printk.c | 363 +++ .../huawei/bma/kbox_drv/kbox_printk.h | 33 + .../huawei/bma/kbox_drv/kbox_ram_drive.c | 188 ++ .../huawei/bma/kbox_drv/kbox_ram_drive.h | 31 + .../huawei/bma/kbox_drv/kbox_ram_image.c | 135 + .../huawei/bma/kbox_drv/kbox_ram_image.h | 84 + .../huawei/bma/kbox_drv/kbox_ram_op.c | 986 +++++++ .../huawei/bma/kbox_drv/kbox_ram_op.h | 77 + .../net/ethernet/huawei/bma/veth_drv/Makefile | 2 + .../ethernet/huawei/bma/veth_drv/veth_hb.c | 2504 +++++++++++++++++ .../ethernet/huawei/bma/veth_drv/veth_hb.h | 440 +++ 43 files changed, 11751 insertions(+) create mode 100644 drivers/net/ethernet/huawei/bma/Kconfig create mode 100644 drivers/net/ethernet/huawei/bma/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.h create mode 100644 drivers/net/ethernet/huawei/bma/include/bma_ker_intf.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.h create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h -- 2.27.0

2 7

[PATCH OLK-5.10] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v5.10.199 commit a424807d860ba816aaafc3064b46b456361c0802 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index ed9019d807c7..4c931bd1c174 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -894,6 +894,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v4.19.297 commit a686f84101680b8442181a8846fbd3c934653729 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 75017a345b5a..6ba0cdbf8c4a 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -902,6 +902,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 12 Mar '24

12 Mar '24

Wang ShaoBo (1): arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak Zeng Heng (1): arm64/mpam: Fix use-after-free when deleting resource groups arch/arm64/include/asm/resctrl.h | 18 +++++++++++++ arch/arm64/kernel/mpam/mpam_ctrlmon.c | 8 ------ arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- fs/resctrlfs.c | 37 ++++++++++----------------- 4 files changed, 32 insertions(+), 33 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 6dcdc42ed081..ec54cd687ef1 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2917,7 +2917,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2933,19 +2932,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 9b9b9557ae74..11f9cb222bdc 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2803,7 +2803,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2819,19 +2818,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1