- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/3] fix CVE-2023-4128 in OLK510
by Liu Jian 14 Aug '23

14 Aug '23

fix CVE-2023-4128 in OLK510 valis (3): net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free net/sched/cls_fw.c | 1 - net/sched/cls_route.c | 1 - net/sched/cls_u32.c | 1 - 3 files changed, 3 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/2] tun/tap: fix CVE-2023-4194
by Dong Chenchen 14 Aug '23

14 Aug '23

The original patches fixing CVE-2023-1076 are incorrect. The patches in this series are supposed to "re-fix" CVE-2023-1076 New CVE is CVE-2023-4194. Laszlo Ersek (2): net: tun_chr_open(): set sk_uid from current_fsuid() net: tap_open(): set sk_uid from current_fsuid() drivers/net/tap.c | 2 +- drivers/net/tun.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 0/3] fix CVE-2023-4128
by Liu Jian 14 Aug '23

14 Aug '23

fix CVE-2023-4128 in openEuler1.0 valis (3): net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free net/sched/cls_fw.c | 1 - net/sched/cls_route.c | 1 - net/sched/cls_u32.c | 1 - 3 files changed, 3 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 v4 00/15] add support for timer_shutdown() api
by Yu Liao 11 Aug '23

11 Aug '23

timer_shutdown_sync() function is useful for final teardown of an infrastructure where the timer is subject to a circular dependency problem. A common pattern for this is a timer and a workqueue where the timer can schedule work and work can arm the timer. On shutdown the workqueue must be destroyed and the timer must be prevented from rearming. Unless the code has conditionals like 'if (mything->in_shutdown)' to prevent that there is no way to get this correct with timer_delete_sync(). timer_shutdown_sync() is solving the problem. The correct ordering of calls in this case is: timer_shutdown_sync(&mything->timer); workqueue_destroy(&mything->workqueue); After this 'mything' can be safely freed. Steven Rostedt (Google) (3): ARM: spear: Do not use timer namespace for timer_shutdown() function clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function Thomas Gleixner (10): timers: Get rid of del_singleshot_timer_sync() timers: Replace BUG_ON()s timers: Update kernel-doc for various functions timers: Use del_timer_sync() even on UP timers: Rename del_timer_sync() to timer_delete_sync() timers: Rename del_timer() to timer_delete() timers: Silently ignore timers with a NULL function timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode timers: Add shutdown mechanism to the internal functions timers: Provide timer_shutdown[_sync]() Yu Liao (2): sw64: Do not use timer namespace for timer_shutdown() function timers: Keep del_timer[_sync]() exported arch/arm/mach-spear/time.c | 8 +- arch/sw_64/kernel/timer.c | 8 +- drivers/char/tpm/tpm-dev-common.c | 4 +- drivers/clocksource/arm_arch_timer.c | 12 +- drivers/clocksource/timer-sp804.c | 6 +- drivers/misc/sgi-xp/xpc_partition.c | 2 +- drivers/staging/wlan-ng/hfa384x_usb.c | 4 +- drivers/staging/wlan-ng/prism2usb.c | 6 +- include/linux/timer.h | 15 +- kernel/time/timer.c | 449 ++++++++++++++++++++------ net/sunrpc/xprt.c | 2 +- 11 files changed, 386 insertions(+), 130 deletions(-) -- 2.25.1

2 16

[PATCH OLK-5.10 v3 00/15] add support for timer_shutdown() api
by Yu Liao 11 Aug '23

11 Aug '23

timer_shutdown_sync() function is useful for final teardown of an infrastructure where the timer is subject to a circular dependency problem. A common pattern for this is a timer and a workqueue where the timer can schedule work and work can arm the timer. On shutdown the workqueue must be destroyed and the timer must be prevented from rearming. Unless the code has conditionals like 'if (mything->in_shutdown)' to prevent that there is no way to get this correct with timer_delete_sync(). timer_shutdown_sync() is solving the problem. The correct ordering of calls in this case is: timer_shutdown_sync(&mything->timer); workqueue_destroy(&mything->workqueue); After this 'mything' can be safely freed. Steven Rostedt (Google) (3): ARM: spear: Do not use timer namespace for timer_shutdown() function clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function Thomas Gleixner (10): timers: Get rid of del_singleshot_timer_sync() timers: Replace BUG_ON()s timers: Update kernel-doc for various functions timers: Use del_timer_sync() even on UP timers: Rename del_timer_sync() to timer_delete_sync() timers: Rename del_timer() to timer_delete() timers: Silently ignore timers with a NULL function timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode timers: Add shutdown mechanism to the internal functions timers: Provide timer_shutdown[_sync]() Yu Liao (2): sw64: Do not use timer namespace for timer_shutdown() function timers: Keep del_timer[_sync]() exported arch/arm/mach-spear/time.c | 8 +- arch/sw_64/kernel/timer.c | 8 +- drivers/char/tpm/tpm-dev-common.c | 4 +- drivers/clocksource/arm_arch_timer.c | 12 +- drivers/clocksource/timer-sp804.c | 6 +- drivers/misc/sgi-xp/xpc_partition.c | 2 +- drivers/staging/wlan-ng/hfa384x_usb.c | 4 +- drivers/staging/wlan-ng/prism2usb.c | 6 +- include/linux/timer.h | 15 +- kernel/time/timer.c | 449 ++++++++++++++++++++------ net/sunrpc/xprt.c | 2 +- 11 files changed, 386 insertions(+), 130 deletions(-) -- 2.25.1

2 16

[PATCH v2 OLK-5.10 00/13] add support for timer_shutdown() api
by Yu Liao 11 Aug '23

11 Aug '23

timer_shutdown_sync() function is useful for final teardown of an infrastructure where the timer is subject to a circular dependency problem. A common pattern for this is a timer and a workqueue where the timer can schedule work and work can arm the timer. On shutdown the workqueue must be destroyed and the timer must be prevented from rearming. Unless the code has conditionals like 'if (mything->in_shutdown)' to prevent that there is no way to get this correct with timer_delete_sync(). timer_shutdown_sync() is solving the problem. The correct ordering of calls in this case is: timer_shutdown_sync(&mything->timer); workqueue_destroy(&mything->workqueue); After this 'mything' can be safely freed. Steven Rostedt (Google) (2): clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function Thomas Gleixner (10): timers: Get rid of del_singleshot_timer_sync() timers: Replace BUG_ON()s timers: Update kernel-doc for various functions timers: Use del_timer_sync() even on UP timers: Rename del_timer_sync() to timer_delete_sync() timers: Rename del_timer() to timer_delete() timers: Silently ignore timers with a NULL function timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode timers: Add shutdown mechanism to the internal functions timers: Provide timer_shutdown[_sync]() Yu Liao (1): timers: Keep del_timer[_sync]() exported drivers/char/tpm/tpm-dev-common.c | 4 +- drivers/clocksource/arm_arch_timer.c | 12 +- drivers/clocksource/timer-sp804.c | 6 +- drivers/misc/sgi-xp/xpc_partition.c | 2 +- drivers/staging/wlan-ng/hfa384x_usb.c | 4 +- drivers/staging/wlan-ng/prism2usb.c | 6 +- include/linux/timer.h | 15 +- kernel/time/timer.c | 449 ++++++++++++++++++++------ net/sunrpc/xprt.c | 2 +- 9 files changed, 378 insertions(+), 122 deletions(-) -- 2.25.1

2 14

[PATCH OLK-5.10 00/17] add support for timer_shutdown() api
by Yu Liao 11 Aug '23

11 Aug '23

timer_shutdown_sync() function is useful for final teardown of an infrastructure where the timer is subject to a circular dependency problem. A common pattern for this is a timer and a workqueue where the timer can schedule work and work can arm the timer. On shutdown the workqueue must be destroyed and the timer must be prevented from rearming. Unless the code has conditionals like 'if (mything->in_shutdown)' to prevent that there is no way to get this correct with timer_delete_sync(). timer_shutdown_sync() is solving the problem. The correct ordering of calls in this case is: timer_shutdown_sync(&mything->timer); workqueue_destroy(&mything->workqueue); After this 'mything' can be safely freed. Steven Rostedt (Google) (4): ARM: spear: Do not use timer namespace for timer_shutdown() function clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function timers: Update the documentation to reflect on the new timer_shutdown() API Thomas Gleixner (12): Documentation: Remove bogus claim about del_timer_sync() timers: Get rid of del_singleshot_timer_sync() timers: Replace BUG_ON()s timers: Update kernel-doc for various functions timers: Use del_timer_sync() even on UP timers: Rename del_timer_sync() to timer_delete_sync() timers: Rename del_timer() to timer_delete() Documentation: Replace del_timer/del_timer_sync() timers: Silently ignore timers with a NULL function timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode timers: Add shutdown mechanism to the internal functions timers: Provide timer_shutdown[_sync]() Yu Liao (1): timers: Keep del_timer[_sync]() exported .../RCU/Design/Requirements/Requirements.rst | 2 +- Documentation/core-api/local_ops.rst | 2 +- Documentation/kernel-hacking/locking.rst | 17 +- Documentation/timers/hrtimers.rst | 2 +- .../it_IT/kernel-hacking/locking.rst | 14 +- .../translations/zh_CN/core-api/local_ops.rst | 196 ++++++++ arch/arm/mach-spear/time.c | 8 +- drivers/char/tpm/tpm-dev-common.c | 4 +- drivers/clocksource/arm_arch_timer.c | 12 +- drivers/clocksource/timer-sp804.c | 6 +- drivers/misc/sgi-xp/xpc_partition.c | 2 +- drivers/staging/wlan-ng/hfa384x_usb.c | 4 +- drivers/staging/wlan-ng/prism2usb.c | 6 +- include/linux/timer.h | 15 +- kernel/time/timer.c | 449 ++++++++++++++---- net/sunrpc/xprt.c | 2 +- 16 files changed, 597 insertions(+), 144 deletions(-) create mode 100644 Documentation/translations/zh_CN/core-api/local_ops.rst -- 2.25.1

1 17

[PATCH OLK-5.10 0/2] Cmdline for ARMv8 Pointer Authentication
by GONG, Ruiqi 11 Aug '23

11 Aug '23

GONG, Ruiqi (1): arm64: add cmdline to control ptrauth feature at boot Srinivas Ramana (1): arm64: Defer enabling pointer authentication on boot core arch/arm64/include/asm/pointer_auth.h | 10 +++++ arch/arm64/include/asm/stackprotector.h | 1 + arch/arm64/kernel/cpufeature.c | 54 ++++++++++++++++++++----- arch/arm64/kernel/head.S | 4 -- 4 files changed, 55 insertions(+), 14 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
by Lu Wei 10 Aug '23

10 Aug '23

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.5-rc4 commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7QG0U CVE: CVE-2023-4147 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Bail out with EOPNOTSUPP when adding rule to bound chain via NFTA_RULE_CHAIN_ID. The following warning splat is shown when adding a rule to a deleted bound chain: WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Reported-by: Kevin Rich <kevinrich1337(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/nf_tables_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index b7c915bcdcf2..3b2275b151a2 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3255,8 +3255,6 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); return PTR_ERR(chain); } - if (nft_chain_is_bound(chain)) - return -EOPNOTSUPP; } else if (nla[NFTA_RULE_CHAIN_ID]) { chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID], @@ -3269,6 +3267,9 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, return -EINVAL; } + if (nft_chain_is_bound(chain)) + return -EOPNOTSUPP; + if (nla[NFTA_RULE_HANDLE]) { handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); rule = __nft_rule_lookup(chain, handle); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] xfrm: add NULL check in xfrm_update_ae_params
by Zhengchao Shao 09 Aug '23

09 Aug '23

From: Lin Ma <linma(a)zju.edu.cn> mainline inclusion from mainline-v6.5-rc3 commit 00374d9b6d9f932802b55181be9831aa948e5b7c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7NYWN CVE: CVE-2023-3772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700 This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD. Fixes: d8647b79c3b7 ("xfrm: Add user interface for esn and big anti-replay windows") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_user.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 87932f6ad9d7..73600b9d42dd 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -521,7 +521,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; - if (re) { + if (re && x->replay_esn && x->preplay_esn) { struct xfrm_replay_state_esn *replay_esn; replay_esn = nla_data(re); memcpy(x->replay_esn, replay_esn, -- 2.34.1

2 1

[PATCH OLK-5.10] xfrm: add NULL check in xfrm_update_ae_params
by Zhengchao Shao 09 Aug '23

09 Aug '23

From: Lin Ma <linma(a)zju.edu.cn> mainline inclusion from mainline-v6.5-rc3 commit 00374d9b6d9f932802b55181be9831aa948e5b7c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7NYWN CVE: CVE-2023-3772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700 This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD. Fixes: d8647b79c3b7 ("xfrm: Add user interface for esn and big anti-replay windows") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_user.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 4a307106f98f..138f71c67969 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -522,7 +522,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs, struct nlattr *et = attrs[XFRMA_ETIMER_THRESH]; struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH]; - if (re) { + if (re && x->replay_esn && x->preplay_esn) { struct xfrm_replay_state_esn *replay_esn; replay_esn = nla_data(re); memcpy(x->replay_esn, replay_esn, -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Backport cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks()
by Cai Xinchen 09 Aug '23

09 Aug '23

Backport cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks() and cgroup: Use cgroup_attach_{lock,unlock}() from cgroup_attach_task_all() Qi Zheng (1): cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks() Tetsuo Handa (1): cgroup: Use cgroup_attach_{lock,unlock}() from cgroup_attach_task_all() kernel/cgroup/cgroup-internal.h | 2 ++ kernel/cgroup/cgroup-v1.c | 10 ++++------ kernel/cgroup/cgroup.c | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) -- 2.17.1

2 3

[PATCH openEuler-23.09 00/25] backport etmem feature from OLK-5.10
by liubo 09 Aug '23

09 Aug '23

Kemeng Shi (11): etmem: add ioctl for mm idle scan etmem: x86: support scan hugetlb of vm etmem_scan: x86: support scan 4 level ept under 5 level host page table etmem scan: fix memleak in vm_idle_read etmem: fix concurrent access to export file operations etmem: fix potential UAF when walk ept page table etmem_scan: release CPU after scan walk_step size etmem_scan: add pte_hole callback acpi/numa: memorize node type from SRAT table hugepage: add sysctl for hugepage alloc and mig x86: hugepage: use nt copy hugepage to AEP in x86 liubo (14): memig: add memig-scan feature to openEuler memig: add memig-swap feature to openEuler memig: fix compile error when CONFIG_NUMA is turned off etmem: Modify the memig feature name to etmem move ETMEM feature CONFIG to mm/Kconfig and add architecture dependency etmem: etmem scan module Replace WARN_ONCE() with debug_printk for "nothing read" add ETMEM feature CONFIG to mm/Kconfig config: enable CONFIG_ETMEM by default etmem: add CONFIG_ETMEM macro definition for etmem feature etmem: add original kernel swap enabled options etmem: add swapcache reclaim to etmem etmem: Add a scan flag to support specified page swap-out etmem: fix the div 0 problem in swapcache reclaim process etmem: fix some problem during backport etmem patches arch/arm64/configs/openeuler_defconfig | 3 + arch/x86/configs/openeuler_defconfig | 3 + arch/x86/include/asm/page_64.h | 7 + arch/x86/lib/Makefile | 1 + arch/x86/lib/copy_highpages.c | 107 ++ arch/x86/lib/copy_page_64.S | 73 ++ drivers/acpi/numa/srat.c | 5 + fs/proc/Makefile | 2 + fs/proc/base.c | 8 + fs/proc/etmem_scan.c | 1383 ++++++++++++++++++++++++ fs/proc/etmem_scan.h | 149 +++ fs/proc/etmem_swap.c | 282 +++++ fs/proc/internal.h | 4 + fs/proc/task_mmu.c | 194 ++++ include/linux/highmem.h | 17 + include/linux/hugetlb.h | 6 + include/linux/list.h | 17 + include/linux/mm.h | 4 + include/linux/mm_types.h | 18 +- include/linux/numa.h | 12 + include/linux/swap.h | 38 + include/uapi/asm-generic/mman-common.h | 3 + kernel/sysctl.c | 20 + mm/Kconfig | 25 + mm/huge_memory.c | 1 + mm/hugetlb.c | 7 +- mm/internal.h | 1 - mm/madvise.c | 17 +- mm/page_alloc.c | 13 + mm/pagewalk.c | 1 + mm/swap_state.c | 37 + mm/util.c | 11 +- mm/vmscan.c | 390 +++++++ virt/kvm/kvm_main.c | 6 + 34 files changed, 2852 insertions(+), 13 deletions(-) create mode 100644 arch/x86/lib/copy_highpages.c create mode 100644 fs/proc/etmem_scan.c create mode 100644 fs/proc/etmem_scan.h create mode 100644 fs/proc/etmem_swap.c -- 2.33.0

2 26

[PATCH OLK-5.10 v3 0/4] Mainline bugfix patches backport 5.10
by Guo Mengqi 09 Aug '23

09 Aug '23

Andy Shevchenko (1): lib/cmdline: fix get_option() for strings starting with hyphen Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Sumera Priyadarsini (1): bus: arm-integrator-lm: Add of_node_put() before return statement drivers/base/base.h | 1 + drivers/base/core.c | 35 +++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/bus/arm-integrator-lm.c | 1 + lib/cmdline.c | 8 +++++++- lib/genalloc.c | 3 ++- 6 files changed, 49 insertions(+), 3 deletions(-) -- 2.17.1

2 5

[PATCH OLK-5.10 1/2] cgroup: Use cgroup_attach_{lock,unlock}() from cgroup_attach_task_all()
by Cai Xinchen 09 Aug '23

09 Aug '23

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v6.1-rc1 commit 075b593f54f0f3883532cb750081cae6917bc8fe category: cleanup bugzilla: 189018, https://gitee.com/openeuler/kernel/issues/I7RPDX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- No behavior changes; preparing for potential locking changes in future. Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reviewed-by:Mukesh Ojha <quic_mojha(a)quicinc.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- kernel/cgroup/cgroup-internal.h | 2 ++ kernel/cgroup/cgroup-v1.c | 6 ++---- kernel/cgroup/cgroup.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h index 3f116765bb00..6fc71b98209e 100644 --- a/kernel/cgroup/cgroup-internal.h +++ b/kernel/cgroup/cgroup-internal.h @@ -250,6 +250,8 @@ int cgroup_migrate(struct task_struct *leader, bool threadgroup, int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader, bool threadgroup); +void cgroup_attach_lock(bool lock_threadgroup); +void cgroup_attach_unlock(bool lock_threadgroup); struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup, bool *locked) __acquires(&cgroup_threadgroup_rwsem); diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 647d0891cff6..d7e2d232acc4 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -57,8 +57,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) int retval = 0; mutex_lock(&cgroup_mutex); - cpus_read_lock(); - percpu_down_write(&cgroup_threadgroup_rwsem); + cgroup_attach_lock(true); for_each_root(root) { struct cgroup *from_cgrp; @@ -73,8 +72,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) if (retval) break; } - percpu_up_write(&cgroup_threadgroup_rwsem); - cpus_read_unlock(); + cgroup_attach_unlock(true); mutex_unlock(&cgroup_mutex); return retval; diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index d0a4a1c4c38d..2bc5bae49d20 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2367,7 +2367,7 @@ EXPORT_SYMBOL_GPL(task_cgroup_path); * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assume that * CPU hotplug is disabled on entry. */ -static void cgroup_attach_lock(bool lock_threadgroup) +void cgroup_attach_lock(bool lock_threadgroup) { cpus_read_lock(); if (lock_threadgroup) @@ -2378,7 +2378,7 @@ static void cgroup_attach_lock(bool lock_threadgroup) * cgroup_attach_unlock - Undo cgroup_attach_lock() * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem */ -static void cgroup_attach_unlock(bool lock_threadgroup) +void cgroup_attach_unlock(bool lock_threadgroup) { if (lock_threadgroup) percpu_up_write(&cgroup_threadgroup_rwsem); -- 2.17.1

2 2

[PATCH openEuler-1.0-LTS] cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks()
by Cai Xinchen 09 Aug '23

09 Aug '23

From: Qi Zheng <zhengqi.arch(a)bytedance.com> mainline inclusion from mainline-v6.4-rc6 commit ab1de7ead871ebe6d12a774c3c25de0388cde082 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7RPDX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- The commit 4f7e7236435c ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") fixed the deadlock between cgroup_threadgroup_rwsem and cpus_read_lock() by introducing cgroup_attach_{lock,unlock}() and removing cpus_read_{lock,unlock}() from cpuset_attach(). But cgroup_transfer_tasks() was missed and not handled, which will cause th following warning: WARNING: CPU: 0 PID: 589 at kernel/cpu.c:526 lockdep_assert_cpus_held+0x32/0x40 CPU: 0 PID: 589 Comm: kworker/1:4 Not tainted 6.4.0-rc2-next-20230517 #50 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: events cpuset_hotplug_workfn RIP: 0010:lockdep_assert_cpus_held+0x32/0x40 <...> Call Trace: <TASK> cpuset_attach+0x40/0x240 cgroup_migrate_execute+0x452/0x5e0 ? _raw_spin_unlock_irq+0x28/0x40 cgroup_transfer_tasks+0x1f3/0x360 ? find_held_lock+0x32/0x90 ? cpuset_hotplug_workfn+0xc81/0xed0 cpuset_hotplug_workfn+0xcb1/0xed0 ? process_one_work+0x248/0x5b0 process_one_work+0x2b9/0x5b0 worker_thread+0x56/0x3b0 ? process_one_work+0x5b0/0x5b0 kthread+0xf1/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> So just use the cgroup_attach_{lock,unlock}() helper to fix it. Reported-by: Zhao Gongyi <zhaogongyi(a)bytedance.com> Signed-off-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Acked-by: Muchun Song <songmuchun(a)bytedance.com> Fixes: 05c7b7a92cc8 ("cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug") Cc: stable(a)vger.kernel.org # v5.17+ Signed-off-by: Tejun Heo <tj(a)kernel.org> conflicts: kernel/cgroup/cgroup-v1.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- kernel/cgroup/cgroup-v1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 8bd36f2143eb..2e3748b1a333 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -105,7 +105,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) mutex_lock(&cgroup_mutex); - percpu_down_write(&cgroup_threadgroup_rwsem); + cgroup_attach_lock(); /* all tasks in @from are being moved, all csets are source */ spin_lock_irq(&css_set_lock); @@ -141,7 +141,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) } while (task && !ret); out_err: cgroup_migrate_finish(&mgctx); - percpu_up_write(&cgroup_threadgroup_rwsem); + cgroup_attach_unlock(); mutex_unlock(&cgroup_mutex); return ret; } -- 2.17.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 09 Aug '23

09 Aug '23

您好！ Kernel SIG 邀请您参加 2023-08-11 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可直接回复邮件，或直接录入会议看板）会议链接：https://us06web.zoom.us/j/86358182582?pwd=YTRkUmFhb1pSYmFaV1FVUlkwWUZoUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-08-11 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可直接回复邮件，或直接录入会议看板） You can join the meeting at https://us06web.zoom.us/j/86358182582?pwd=YTRkUmFhb1pSYmFaV1FVUlkwWUZoUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS v3 0/8] add support for timer_shutdown
by Yu Liao 08 Aug '23

08 Aug '23

*** BLURB HERE *** Steven Rostedt (Google) (3): [Backport] ARM: spear: Do not use timer namespace for timer_shutdown() function [Backport] clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function [Backport] clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function Thomas Gleixner (5): [Backport] timers: Replace BUG_ON()s [Backport] timers: Silently ignore timers with a NULL function [Backport] timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode [Backport] timers: Add shutdown mechanism to the internal functions [Backport] timers: Provide timer_shutdown[_sync]() arch/arm/mach-spear/time.c | 8 +- drivers/clocksource/arm_arch_timer.c | 12 +- drivers/clocksource/timer-sp804.c | 6 +- include/linux/timer.h | 2 + kernel/time/timer.c | 326 ++++++++++++++++++++++----- 5 files changed, 284 insertions(+), 70 deletions(-) -- 2.33.0

2 9

[PATCH openEuler-1.0-LTS v3 1/8] ARM: spear: Do not use timer namespace for timer_shutdown() function
by Yu Liao 08 Aug '23

08 Aug '23

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.2-rc1 commit 80b55772d41d8afec68dbc4ff0368a9fe5d1f390 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A new "shutdown" timer state is being added to the generic timer code. One of the functions to change the timer into the state is called "timer_shutdown()". This means that there can not be other functions called "timer_shutdown()" as the timer code owns the "timer_*" name space. Rename timer_shutdown() to spear_timer_shutdown() to avoid this conflict. Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Reviewed-by: Anna-Maria Behnsen <anna-maria(a)linutronix.de> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Link: https://lkml.kernel.org/r/20221106212701.822440504@goodmis.org Link: https://lore.kernel.org/all/20221105060155.228348078@goodmis.org/ Link: https://lore.kernel.org/r/20221110064146.810953418@goodmis.org Link: https://lore.kernel.org/r/20221123201624.513863211@linutronix.de Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- arch/arm/mach-spear/time.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c index 289e036c9c30..57ff0787bad3 100644 --- a/arch/arm/mach-spear/time.c +++ b/arch/arm/mach-spear/time.c @@ -93,7 +93,7 @@ static void __init spear_clocksource_init(void) 200, 16, clocksource_mmio_readw_up); } -static inline void timer_shutdown(struct clock_event_device *evt) +static inline void spear_timer_shutdown(struct clock_event_device *evt) { u16 val = readw(gpt_base + CR(CLKEVT)); @@ -104,7 +104,7 @@ static inline void timer_shutdown(struct clock_event_device *evt) static int spear_shutdown(struct clock_event_device *evt) { - timer_shutdown(evt); + spear_timer_shutdown(evt); return 0; } @@ -114,7 +114,7 @@ static int spear_set_oneshot(struct clock_event_device *evt) u16 val; /* stop the timer */ - timer_shutdown(evt); + spear_timer_shutdown(evt); val = readw(gpt_base + CR(CLKEVT)); val |= CTRL_ONE_SHOT; @@ -129,7 +129,7 @@ static int spear_set_periodic(struct clock_event_device *evt) u16 val; /* stop the timer */ - timer_shutdown(evt); + spear_timer_shutdown(evt); period = clk_get_rate(gpt_clk) / HZ; period >>= CTRL_PRESCALER16; -- 2.33.0

2 8

[PATCH openEuler-1.0-LTS v2 1/8] ARM: spear: Do not use timer namespace for timer_shutdown() function
by Yu Liao 08 Aug '23

08 Aug '23

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.2-rc1 commit 80b55772d41d8afec68dbc4ff0368a9fe5d1f390 bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A new "shutdown" timer state is being added to the generic timer code. One of the functions to change the timer into the state is called "timer_shutdown()". This means that there can not be other functions called "timer_shutdown()" as the timer code owns the "timer_*" name space. Rename timer_shutdown() to spear_timer_shutdown() to avoid this conflict. Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Reviewed-by: Anna-Maria Behnsen <anna-maria(a)linutronix.de> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Link: https://lkml.kernel.org/r/20221106212701.822440504@goodmis.org Link: https://lore.kernel.org/all/20221105060155.228348078@goodmis.org/ Link: https://lore.kernel.org/r/20221110064146.810953418@goodmis.org Link: https://lore.kernel.org/r/20221123201624.513863211@linutronix.de Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- arch/arm/mach-spear/time.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c index 289e036c9c30..57ff0787bad3 100644 --- a/arch/arm/mach-spear/time.c +++ b/arch/arm/mach-spear/time.c @@ -93,7 +93,7 @@ static void __init spear_clocksource_init(void) 200, 16, clocksource_mmio_readw_up); } -static inline void timer_shutdown(struct clock_event_device *evt) +static inline void spear_timer_shutdown(struct clock_event_device *evt) { u16 val = readw(gpt_base + CR(CLKEVT)); @@ -104,7 +104,7 @@ static inline void timer_shutdown(struct clock_event_device *evt) static int spear_shutdown(struct clock_event_device *evt) { - timer_shutdown(evt); + spear_timer_shutdown(evt); return 0; } @@ -114,7 +114,7 @@ static int spear_set_oneshot(struct clock_event_device *evt) u16 val; /* stop the timer */ - timer_shutdown(evt); + spear_timer_shutdown(evt); val = readw(gpt_base + CR(CLKEVT)); val |= CTRL_ONE_SHOT; @@ -129,7 +129,7 @@ static int spear_set_periodic(struct clock_event_device *evt) u16 val; /* stop the timer */ - timer_shutdown(evt); + spear_timer_shutdown(evt); period = clk_get_rate(gpt_clk) / HZ; period >>= CTRL_PRESCALER16; -- 2.33.0

2 8

[PATCH openEuler-1.0-LTS 1/8] [Backport] ARM: spear: Do not use timer namespace for timer_shutdown() function
by Yu Liao 08 Aug '23

08 Aug '23

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.2-rc1 commit 80b55772d41d8afec68dbc4ff0368a9fe5d1f390 bugzilla: https://gitee.com/openeuler/kernel/issues/I7R8WG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A new "shutdown" timer state is being added to the generic timer code. One of the functions to change the timer into the state is called "timer_shutdown()". This means that there can not be other functions called "timer_shutdown()" as the timer code owns the "timer_*" name space. Rename timer_shutdown() to spear_timer_shutdown() to avoid this conflict. Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Reviewed-by: Anna-Maria Behnsen <anna-maria(a)linutronix.de> Acked-by: Arnd Bergmann <arnd(a)arndb.de> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Link: https://lkml.kernel.org/r/20221106212701.822440504@goodmis.org Link: https://lore.kernel.org/all/20221105060155.228348078@goodmis.org/ Link: https://lore.kernel.org/r/20221110064146.810953418@goodmis.org Link: https://lore.kernel.org/r/20221123201624.513863211@linutronix.de Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- arch/arm/mach-spear/time.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c index 289e036c9c30..57ff0787bad3 100644 --- a/arch/arm/mach-spear/time.c +++ b/arch/arm/mach-spear/time.c @@ -93,7 +93,7 @@ static void __init spear_clocksource_init(void) 200, 16, clocksource_mmio_readw_up); } -static inline void timer_shutdown(struct clock_event_device *evt) +static inline void spear_timer_shutdown(struct clock_event_device *evt) { u16 val = readw(gpt_base + CR(CLKEVT)); @@ -104,7 +104,7 @@ static inline void timer_shutdown(struct clock_event_device *evt) static int spear_shutdown(struct clock_event_device *evt) { - timer_shutdown(evt); + spear_timer_shutdown(evt); return 0; } @@ -114,7 +114,7 @@ static int spear_set_oneshot(struct clock_event_device *evt) u16 val; /* stop the timer */ - timer_shutdown(evt); + spear_timer_shutdown(evt); val = readw(gpt_base + CR(CLKEVT)); val |= CTRL_ONE_SHOT; @@ -129,7 +129,7 @@ static int spear_set_periodic(struct clock_event_device *evt) u16 val; /* stop the timer */ - timer_shutdown(evt); + spear_timer_shutdown(evt); period = clk_get_rate(gpt_clk) / HZ; period >>= CTRL_PRESCALER16; -- 2.33.0

2 8

[PATCH OLK-5.10] nvme-pci: fix DMA direction of unmapping integrity data
by Yong Hu 08 Aug '23

08 Aug '23

From: Ming Lei <ming.lei(a)redhat.com> stable inclusion from stable-v5.10.188 commit cc512539c44f173c2a5fc967e4feb0043bc5773d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8f6446b6853768cb99e7c201bddce69ca60c15e ] DMA direction should be taken in dma_unmap_page() for unmapping integrity data. Fix this DMA direction, and reported in Guangwu's test. Reported-by: Guangwu Zhang <guazhang(a)redhat.com> Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data") Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index f1ac50c7a1d6..c3739b895d0d 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -968,7 +968,8 @@ static void nvme_pci_complete_rq(struct request *req) if (blk_integrity_rq(req)) dma_unmap_page(dev->dev, iod->meta_dma, - rq_integrity_vec(req)->bv_len, rq_data_dir(req)); + rq_integrity_vec(req)->bv_len, rq_dma_dir(req)); + if (blk_rq_nr_phys_segments(req)) nvme_unmap_data(dev, req); nvme_complete_rq(req); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] x86/cpu/amd: Add a Zenbleed fix
by Wang ShaoBo 08 Aug '23

08 Aug '23

From: "Borislav Petkov (AMD)" <bp(a)alien8.de> stable inclusion from stable-v4.19.289 commit cfef7bbf0dca27209ea5d82d7060d4fc2c0d72ea category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7RC8S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Upstream commit: 522b1d69219d8f083173819fde04f994aa051a98 Add a fix for the Zen2 VZEROUPPER data corruption bug where under certain circumstances executing VZEROUPPER can cause register corruption or leak data. The optimal fix is through microcode but in the case the proper microcode revision has not been applied, enable a fallback fix using a chicken bit. Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/microcode_amd.h arch/x86/include/asm/msr-index.h arch/x86/kernel/cpu/amd.c Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/x86/include/asm/microcode.h | 1 + arch/x86/include/asm/microcode_amd.h | 2 + arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/cpu/amd.c | 60 ++++++++++++++++++++++++++++ arch/x86/kernel/cpu/common.c | 2 + 5 files changed, 66 insertions(+) diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h index 91a06cef50c1b..3e398751b73cd 100644 --- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -5,6 +5,7 @@ #include <asm/cpu.h> #include <linux/earlycpio.h> #include <linux/initrd.h> +#include <asm/microcode_amd.h> struct ucode_patch { struct list_head plist; diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h index 5c524d4f71cd7..bdecac3ae8c3b 100644 --- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -48,11 +48,13 @@ extern void __init load_ucode_amd_bsp(unsigned int family); extern void load_ucode_amd_ap(unsigned int family); extern int __init save_microcode_in_initrd_amd(unsigned int family); void reload_ucode_amd(void); +extern void amd_check_microcode(void); #else static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } void reload_ucode_amd(void) {} +static inline void amd_check_microcode(void) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index 779b653f65461..4431a376282ad 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -404,6 +404,7 @@ #define MSR_AMD64_OSVW_STATUS 0xc0010141 #define MSR_AMD64_LS_CFG 0xc0011020 #define MSR_AMD64_DC_CFG 0xc0011022 +#define MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT 9 #define MSR_AMD64_BU_CFG2 0xc001102a #define MSR_AMD64_IBSFETCHCTL 0xc0011030 #define MSR_AMD64_IBSFETCHLINAD 0xc0011031 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index 254bd1c35e528..4d69686c2380f 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -25,6 +25,7 @@ static const int amd_erratum_383[]; static const int amd_erratum_400[]; +static const int amd_zenbleed[]; static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum); /* @@ -901,6 +902,47 @@ static void init_amd_zn(struct cpuinfo_x86 *c) } } +static bool cpu_has_zenbleed_microcode(void) +{ + u32 good_rev = 0; + + switch (boot_cpu_data.x86_model) { + case 0x30 ... 0x3f: good_rev = 0x0830107a; break; + case 0x60 ... 0x67: good_rev = 0x0860010b; break; + case 0x68 ... 0x6f: good_rev = 0x08608105; break; + case 0x70 ... 0x7f: good_rev = 0x08701032; break; + case 0xa0 ... 0xaf: good_rev = 0x08a00008; break; + + default: + return false; + break; + } + + if (boot_cpu_data.microcode < good_rev) + return false; + + return true; +} + +static void zenbleed_check(struct cpuinfo_x86 *c) +{ + if (!cpu_has_amd_erratum(c, amd_zenbleed)) + return; + + if (cpu_has(c, X86_FEATURE_HYPERVISOR)) + return; + + if (!cpu_has(c, X86_FEATURE_AVX)) + return; + + if (!cpu_has_zenbleed_microcode()) { + pr_notice_once("Zenbleed: please update your microcode for the most optimal fix\n"); + msr_set_bit(MSR_AMD64_DE_CFG, MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT); + } else { + msr_clear_bit(MSR_AMD64_DE_CFG, MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT); + } +} + static void init_amd(struct cpuinfo_x86 *c) { early_init_amd(c); @@ -995,6 +1037,8 @@ static void init_amd(struct cpuinfo_x86 *c) set_cpu_bug(c, X86_BUG_SYSRET_SS_ATTRS); check_null_seg_clears_base(c); + + zenbleed_check(c); } #ifdef CONFIG_X86_32 @@ -1122,6 +1166,10 @@ static const int amd_erratum_400[] = static const int amd_erratum_383[] = AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0, 0, 0xff, 0xf)); +static const int amd_zenbleed[] = + AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x30, 0x0, 0x4f, 0xf), + AMD_MODEL_RANGE(0x17, 0x60, 0x0, 0x7f, 0xf), + AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf)); static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum) { @@ -1172,3 +1220,15 @@ void set_dr_addr_mask(unsigned long mask, int dr) break; } } + +static void zenbleed_check_cpu(void *unused) +{ + struct cpuinfo_x86 *c = &cpu_data(smp_processor_id()); + + zenbleed_check(c); +} + +void amd_check_microcode(void) +{ + on_each_cpu(zenbleed_check_cpu, NULL, 1); +} diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index ee8df42c5e1f2..2abc1b53f9314 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2152,6 +2152,8 @@ void microcode_check(void) perf_check_microcode(); + amd_check_microcode(); + /* Reload CPUID max function as it might've changed. */ info.cpuid_level = cpuid_eax(0); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Revert "arm64/mpam: Fix mpam corrupt when cpu online"
by Wang ShaoBo 08 Aug '23

08 Aug '23

hulk inclusion category: bugfix bugzilla: 189067, https://gitee.com/openeuler/kernel/issues/I7PN0A CVE: NA ------------------------------------------------- BUG 'sleeping function called from invalid context' reported when setup MPAM driver, it was blamed to 0f4acaeb21a72 ("arm64/mpam: Fix mpam corrupt when cpu online"), which reported a 'Bad PC' BUG, but missing the right conclusion, finally disabling irqs before calling cpuhp_setup_state() may only affect the probability of reproduction. The reason why triggerring 'Bad PC' BUG report is because mpam_enable() is __init type function, and may schedule out after calling __cpuhp_setup_state()->__might_sleep(), so the space of mpam_enable() might be freed after scheduling back. As we have changed mpam_enable() to non-init type function, we can revert commit 0f4acaeb21a72 directly, to solve these both two problems. Fixes: 0f4acaeb21a72 ("arm64/mpam: Fix mpam corrupt when cpu online") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index adf4bc034a51f..b77cea2673c0a 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -596,11 +596,9 @@ static void mpam_enable(struct work_struct *work) pr_err("Failed to setup/init resctrl\n"); mutex_unlock(&mpam_devices_lock); - local_irq_disable(); mpam_cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mpam:online", mpam_cpu_online, mpam_cpu_offline); - local_irq_enable(); if (mpam_cpuhp_state <= 0) pr_err("Failed to re-register 'dyn' cpuhp callbacks"); mutex_unlock(&mpam_cpuhp_lock); -- 2.25.1

1 0

[PATCH 4.19 1/6] dm thin metadata: check fail_io before using data_sm
by Yongqiang Liu 08 Aug '23

08 Aug '23

From: Li Lingfeng <lilingfeng3(a)huawei.com> mainline inclusion from mainline-v6.4-rc8 commit cb65b282c9640c27d3129e2e04b711ce1b352838 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7FIUX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- Must check pmd->fail_io before using pmd->data_sm since pmd->data_sm may be destroyed by other processes. P1(kworker) P2(message) do_worker process_prepared process_prepared_discard_passdown_pt2 dm_pool_dec_data_range pool_message commit dm_pool_commit_metadata ↓ // commit failed metadata_operation_failed abort_transaction dm_pool_abort_metadata __open_or_format_metadata ↓ dm_sm_disk_open ↓ // open failed // pmd->data_sm is NULL dm_sm_dec_blocks ↓ // try to access pmd->data_sm --> UAF As shown above, if dm_pool_commit_metadata() and dm_pool_abort_metadata() fail in pool_message process, kworker may trigger UAF. Fixes: be500ed721a6 ("dm space maps: improve performance with inc/dec on ranges of blocks") Cc: stable(a)vger.kernel.org Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Conflicts: drivers/md/dm-thin-metadata.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin-metadata.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index e37f468cdbf0..bd9466dc9400 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -1711,13 +1711,15 @@ int dm_thin_remove_range(struct dm_thin_device *td, int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result) { - int r; + int r = -EINVAL; uint32_t ref_count; down_read(&pmd->root_lock); - r = dm_sm_get_count(pmd->data_sm, b, &ref_count); - if (!r) - *result = (ref_count > 1); + if (!pmd->fail_io) { + r = dm_sm_get_count(pmd->data_sm, b, &ref_count); + if (!r) + *result = (ref_count > 1); + } up_read(&pmd->root_lock); return r; @@ -1728,10 +1730,14 @@ int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_ int r = 0; down_write(&pmd->root_lock); - for (; b != e; b++) { - r = dm_sm_inc_block(pmd->data_sm, b); - if (r) - break; + if (!pmd->fail_io) { + for (; b != e; b++) { + r = dm_sm_inc_block(pmd->data_sm, b); + if (r) + break; + } + } else { + r = -EINVAL; } up_write(&pmd->root_lock); @@ -1743,10 +1749,14 @@ int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_ int r = 0; down_write(&pmd->root_lock); - for (; b != e; b++) { - r = dm_sm_dec_block(pmd->data_sm, b); - if (r) - break; + if (!pmd->fail_io) { + for (; b != e; b++) { + r = dm_sm_dec_block(pmd->data_sm, b); + if (r) + break; + } + } else { + r = -EINVAL; } up_write(&pmd->root_lock); -- 2.25.1

1 5

[PATCH OLK-5.10] nvme-pci: fix mempool alloc size
by Yong Hu 08 Aug '23

08 Aug '23

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v5.10.188 commit dfb6d54893d544151e7f480bc44cfe7823f5ad23 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit c89a529e823d51dd23c7ec0c047c7a454a428541 ] Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool. While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence. Cc: Jens Axboe <axboe(a)kernel.dk> Fixes: 943e942e6266f ("nvme-pci: limit max IO size and segments to avoid high order allocations") Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 510ce0c145c7..ef2fcd0ed914 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -372,8 +372,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, */ static int nvme_pci_npages_prp(void) { - unsigned nprps = DIV_ROUND_UP(NVME_MAX_KB_SZ + NVME_CTRL_PAGE_SIZE, - NVME_CTRL_PAGE_SIZE); + unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; + unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); return DIV_ROUND_UP(8 * nprps, PAGE_SIZE - 8); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v4 0/3] Mainline bugfix patches backport 4.19
by Guo Mengqi 08 Aug '23

08 Aug '23

Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 +++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 ++++++++++++++++-- lib/genalloc.c | 3 ++- 4 files changed, 34 insertions(+), 8 deletions(-) -- 2.17.1

2 4

[PATCH OLK-5.10] evm: add sm3 config for EVM
by Zhou Shuiqing 08 Aug '23

08 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R99G CVE: NA ------------------------------- Add sm3 algo config for EVM hash algorithm Signed-off-by: Zhou Shuiqing <zhoushuiqing2(a)huawei.com> --- security/integrity/evm/Kconfig | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig index 844f2686cce7..b9a6eb651acf 100644 --- a/security/integrity/evm/Kconfig +++ b/security/integrity/evm/Kconfig @@ -35,6 +35,10 @@ choice config EVM_DEFAULT_HASH_WP512 bool "WP512" depends on CRYPTO_WP512=y + + config EVM_DEFAULT_HASH_SM3 + bool "SM3" + depends on CRYPTO_SM3=y endchoice config EVM_DEFAULT_HASH @@ -44,6 +48,7 @@ config EVM_DEFAULT_HASH default "sha256" if EVM_DEFAULT_HASH_SHA256 default "sha512" if EVM_DEFAULT_HASH_SHA512 default "wp512" if EVM_DEFAULT_HASH_WP512 + default "sm3" if EVM_DEFAULT_HASH_SM3 config EVM_ATTR_FSUUID bool "FSUUID (version 2)" -- 2.33.0

2 1

[PATCH OLK-5.10] uacce: delete the pointer address printing
by Weili Qian 08 Aug '23

08 Aug '23

From: Kai Ye <yekai13(a)huawei.com> driver inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/I7R6TQ CVE: NA ---------------------------------------------------------------------- Deleted the kernel pointer address printing by the security check. Signed-off-by: Kai Ye <yekai13(a)huawei.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> --- drivers/misc/uacce/uacce.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 6d2961676a54..21a4f5892aff 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -177,10 +177,8 @@ static long uacce_get_ss_dma(struct uacce_queue *q, void __user *arg) size = slice[slice_idx].size; if (!size) { max_idx = slice[0].total_num - 1; - dev_err(&uacce->dev, "%luth ss region[0x%lx, %lu] no exist, range[[0](0x%llx, %llu) -> [%u](0x%llx, %llu)]\n", - slice_idx, dma, size, - slice[0].dma, slice[0].size, max_idx, - slice[max_idx].dma, slice[max_idx].size); + dev_err(&uacce->dev, "%luth ss region[size = %lu] no exist, range[[0](size = %llu) -> [%u](size = %llu)]\n", + slice_idx, size, slice[0].size, max_idx, slice[max_idx].size); ret = -ENODEV; goto param_check; } @@ -209,9 +207,7 @@ static void uacce_free_dma_buffers(struct uacce_queue *q) return; while (i < qfr->dma_list[0].total_num) { WARN_ON(!qfr->dma_list[i].size || !qfr->dma_list[i].dma); - dev_dbg(pdev, "free dma qfr (kaddr=%lx, dma=%llx)\n", - (unsigned long)(uintptr_t)qfr->dma_list[i].kaddr, - qfr->dma_list[i].dma); + dev_dbg(pdev, "free dma qfr (index = %d)\n", i); dma_free_coherent(pdev, qfr->dma_list[i].size, qfr->dma_list[i].kaddr, qfr->dma_list[i].dma); @@ -550,8 +546,8 @@ static int uacce_alloc_dma_buffers(struct uacce_queue *q, PAGE_SIZE - 1) & PAGE_MASK, &slice[i].dma, GFP_KERNEL); if (!slice[i].kaddr) { - dev_err(pdev, "Get dma slice(sz=%lu,dma=0x%llx) fail!\n", - size, slice[i].dma); + dev_err(pdev, "get dma slice(sz = %lu,slice num = %d) fail!\n", + size, i); slice[0].total_num = i; uacce_free_dma_buffers(q); return -ENOMEM; @@ -594,8 +590,8 @@ static int uacce_mmap_dma_buffers(struct uacce_queue *q, slice[i].dma, slice[i].size); if (ret) { - dev_err(pdev, "dma mmap fail(dma=0x%llx,size=0x%llx)!\n", - slice[i].dma, slice[i].size); + dev_err(pdev, "dma mmap fail(dma index = %d, size = %llu)!\n", + i, slice[i].size); goto DMA_MMAP_FAIL; } @@ -846,10 +842,11 @@ static ssize_t dev_state_show(struct device *dev, static ssize_t node_id_show(struct device *dev, struct device_attribute *attr, char *buf) { - struct uacce_device *uacce = to_uacce_device(dev); int node_id = -1; #ifdef CONFIG_NUMA + struct uacce_device *uacce = to_uacce_device(dev); + node_id = uacce->parent->numa_node; #endif return sysfs_emit(buf, "%d\n", node_id); @@ -858,10 +855,11 @@ static ssize_t node_id_show(struct device *dev, static ssize_t numa_distance_show(struct device *dev, struct device_attribute *attr, char *buf) { - struct uacce_device *uacce = to_uacce_device(dev); int distance = 0; #ifdef CONFIG_NUMA + struct uacce_device *uacce = to_uacce_device(dev); + distance = node_distance(uacce->parent->numa_node, cpu_to_node(smp_processor_id())); #endif -- 2.30.0

2 1

[PATCH OLK-5.10] mm/ksm: Remove the ksm_merge_any status
by Longlong Xia 08 Aug '23

08 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R48G ---------------------------------------------------------------------- Remove the ksm_merge_any status, as the ksm status of processes within the same cgroup may not be consistent, since the prctl interface can also change the ksm status of a process. Therefore, the ksm_merge_any status may not always represent the ksm status of all processes within a cgroup. Remove it. Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> --- include/linux/memcontrol.h | 4 ---- mm/memcontrol.c | 9 --------- 2 files changed, 13 deletions(-) diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 16b3666393f2..0219e670a436 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -402,11 +402,7 @@ struct mem_cgroup { KABI_RESERVE(3) KABI_RESERVE(4) #endif -#ifdef CONFIG_KSM - KABI_USE(5, bool ksm_merge_any) -#else KABI_RESERVE(5) -#endif #if defined(CONFIG_DYNAMIC_HUGETLB) && defined(CONFIG_ARM64) KABI_USE(6, struct dhugetlb_pool *hpool) #else diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 5082d0664adf..c32010692a1b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5724,9 +5724,6 @@ static int memcg_set_ksm_for_tasks(struct mem_cgroup *memcg, bool enable) struct css_task_iter it; int ret = 0; - if (enable == READ_ONCE(memcg->ksm_merge_any)) - return 0; - css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); while (!ret && (task = css_task_iter_next(&it))) { if (__task_is_dying(task)) @@ -5781,7 +5778,6 @@ static int memory_ksm_show(struct seq_file *m, void *v) } css_task_iter_end(&it); - seq_printf(m, "merge any state: %d\n", READ_ONCE(memcg->ksm_merge_any)); seq_printf(m, "merge any tasks: %u\n", tasks); seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); @@ -5808,8 +5804,6 @@ static ssize_t memory_ksm_write(struct kernfs_open_file *of, char *buf, if (err) return err; - WRITE_ONCE(memcg->ksm_merge_any, enable); - return nbytes; } #endif /* CONFIG_KSM */ @@ -6374,9 +6368,6 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) if (parent != root_mem_cgroup) memory_cgrp_subsys.broken_hierarchy = true; } -#ifdef CONFIG_KSM - memcg->ksm_merge_any = false; -#endif /* The following stuff does not apply to the root */ if (!parent) { root_mem_cgroup = memcg; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v3 0/4] Mainline bugfix patches backport 4.19
by Guo Mengqi 07 Aug '23

07 Aug '23

Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE drivers/base/base.h | 1 + drivers/base/core.c | 35 ++++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 ++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 +++++++++++++++-- lib/genalloc.c | 3 ++- 7 files changed, 73 insertions(+), 9 deletions(-) -- 2.17.1

2 5

[PATCH OLK-5.10 v3 0/4] Mainline bugfix patches backport 5.10
by Guo Mengqi 07 Aug '23

07 Aug '23

Andy Shevchenko (1): lib/cmdline: fix get_option() for strings starting with hyphen Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Sumera Priyadarsini (1): bus: arm-integrator-lm: Add of_node_put() before return statement drivers/base/base.h | 1 + drivers/base/core.c | 35 +++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/bus/arm-integrator-lm.c | 1 + lib/cmdline.c | 8 +++++++- lib/genalloc.c | 3 ++- 6 files changed, 49 insertions(+), 3 deletions(-) -- 2.17.1

1 4

[PATCH OLK-5.10 0/4] Mainilne bugfix patches backport
by Guo Mengqi 07 Aug '23

07 Aug '23

Andy Shevchenko (1): lib/cmdline: fix get_option() for strings starting with hyphen Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Sumera Priyadarsini (1): bus: arm-integrator-lm: Add of_node_put() before return statement drivers/base/base.h | 1 + drivers/base/core.c | 35 +++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/bus/arm-integrator-lm.c | 1 + lib/cmdline.c | 8 +++++++- lib/genalloc.c | 3 ++- 6 files changed, 49 insertions(+), 3 deletions(-) -- 2.17.1

2 5

[PATCH openEuler-1.0-LTS 0/4] Mainline bugfix patches backport
by Guo Mengqi 07 Aug '23

07 Aug '23

Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE drivers/base/base.h | 1 + drivers/base/core.c | 35 ++++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 ++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 +++++++++++++++-- lib/genalloc.c | 3 ++- 7 files changed, 73 insertions(+), 9 deletions(-) -- 2.17.1

2 5

[openEuler-1.0-LTS 1/5] workqueue: Rename "delayed" (delayed by active management) to "inactive"
by Zeng Heng 07 Aug '23

07 Aug '23

From: Lai Jiangshan <laijs(a)linux.alibaba.com> mainline inclusion from mainline-v5.15-rc1 commit f97a4a1a3f8769e3452885967955e21c88f3f263 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7LRJF DTS: DTS2023072811781 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- There are two kinds of "delayed" work items in workqueue subsystem. One is for timer-delayed work items which are visible to workqueue users. The other kind is for work items delayed by active management which can not be directly visible to workqueue users. We mixed the word "delayed" for both kinds and caused somewhat ambiguity. This patch renames the later one (delayed by active management) to "inactive", because it is used for workqueue active management and most of its related symbols are named with "active" or "activate". All "delayed" and "DELAYED" are carefully checked and renamed one by one to avoid accidentally changing the name of the other kind for timer-delayed. No functional change intended. Signed-off-by: Lai Jiangshan <laijs(a)linux.alibaba.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> conflict: kernel/workqueue.c Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/workqueue.h | 4 +-- kernel/workqueue.c | 58 +++++++++++++++++++-------------------- 2 files changed, 31 insertions(+), 31 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 6f2b042fc44c..3ac0fa0c822d 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -30,7 +30,7 @@ void delayed_work_timer_fn(struct timer_list *t); enum { WORK_STRUCT_PENDING_BIT = 0, /* work item is pending execution */ - WORK_STRUCT_DELAYED_BIT = 1, /* work item is delayed */ + WORK_STRUCT_INACTIVE_BIT= 1, /* work item is inactive */ WORK_STRUCT_PWQ_BIT = 2, /* data points to pwq */ WORK_STRUCT_LINKED_BIT = 3, /* next work is linked to this one */ #ifdef CONFIG_DEBUG_OBJECTS_WORK @@ -43,7 +43,7 @@ enum { WORK_STRUCT_COLOR_BITS = 4, WORK_STRUCT_PENDING = 1 << WORK_STRUCT_PENDING_BIT, - WORK_STRUCT_DELAYED = 1 << WORK_STRUCT_DELAYED_BIT, + WORK_STRUCT_INACTIVE = 1 << WORK_STRUCT_INACTIVE_BIT, WORK_STRUCT_PWQ = 1 << WORK_STRUCT_PWQ_BIT, WORK_STRUCT_LINKED = 1 << WORK_STRUCT_LINKED_BIT, #ifdef CONFIG_DEBUG_OBJECTS_WORK diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 04b558a267ae..fe3c4a292909 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -207,7 +207,7 @@ struct pool_workqueue { /* L: nr of in_flight works */ int nr_active; /* L: nr of active works */ int max_active; /* L: max active works */ - struct list_head delayed_works; /* L: delayed works */ + struct list_head inactive_works; /* L: inactive works */ struct list_head pwqs_node; /* WR: node on wq->pwqs */ struct list_head mayday_node; /* MD: node on wq->maydays */ @@ -1105,7 +1105,7 @@ static void put_pwq_unlocked(struct pool_workqueue *pwq) } } -static void pwq_activate_delayed_work(struct work_struct *work) +static void pwq_activate_inactive_work(struct work_struct *work) { struct pool_workqueue *pwq = get_work_pwq(work); @@ -1113,16 +1113,16 @@ static void pwq_activate_delayed_work(struct work_struct *work) if (list_empty(&pwq->pool->worklist)) pwq->pool->watchdog_ts = jiffies; move_linked_works(work, &pwq->pool->worklist, NULL); - __clear_bit(WORK_STRUCT_DELAYED_BIT, work_data_bits(work)); + __clear_bit(WORK_STRUCT_INACTIVE_BIT, work_data_bits(work)); pwq->nr_active++; } -static void pwq_activate_first_delayed(struct pool_workqueue *pwq) +static void pwq_activate_first_inactive(struct pool_workqueue *pwq) { - struct work_struct *work = list_first_entry(&pwq->delayed_works, + struct work_struct *work = list_first_entry(&pwq->inactive_works, struct work_struct, entry); - pwq_activate_delayed_work(work); + pwq_activate_inactive_work(work); } /** @@ -1145,10 +1145,10 @@ static void pwq_dec_nr_in_flight(struct pool_workqueue *pwq, int color) pwq->nr_in_flight[color]--; pwq->nr_active--; - if (!list_empty(&pwq->delayed_works)) { - /* one down, submit a delayed one */ + if (!list_empty(&pwq->inactive_works)) { + /* one down, submit an inactive one */ if (pwq->nr_active < pwq->max_active) - pwq_activate_first_delayed(pwq); + pwq_activate_first_inactive(pwq); } /* is flush in progress and are we at the flushing tip? */ @@ -1246,14 +1246,14 @@ static int try_to_grab_pending(struct work_struct *work, bool is_dwork, debug_work_deactivate(work); /* - * A delayed work item cannot be grabbed directly because + * An inactive work item cannot be grabbed directly because * it might have linked NO_COLOR work items which, if left - * on the delayed_list, will confuse pwq->nr_active + * on the inactive_works list, will confuse pwq->nr_active * management later on and cause stall. Make sure the work * item is activated before grabbing. */ - if (*work_data_bits(work) & WORK_STRUCT_DELAYED) - pwq_activate_delayed_work(work); + if (*work_data_bits(work) & WORK_STRUCT_INACTIVE) + pwq_activate_inactive_work(work); list_del_init(&work->entry); pwq_dec_nr_in_flight(pwq, get_work_color(work)); @@ -1451,8 +1451,8 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, if (list_empty(worklist)) pwq->pool->watchdog_ts = jiffies; } else { - work_flags |= WORK_STRUCT_DELAYED; - worklist = &pwq->delayed_works; + work_flags |= WORK_STRUCT_INACTIVE; + worklist = &pwq->inactive_works; } debug_work_activate(work); @@ -2496,7 +2496,7 @@ static int rescuer_thread(void *__rescuer) /* * The above execution of rescued work items could * have created more to rescue through - * pwq_activate_first_delayed() or chained + * pwq_activate_first_inactive() or chained * queueing. Let's put @pwq back on mayday list so * that such back-to-back work items, which may be * being used to relieve memory pressure, don't @@ -2922,7 +2922,7 @@ void drain_workqueue(struct workqueue_struct *wq) bool drained; spin_lock_irq(&pwq->pool->lock); - drained = !pwq->nr_active && list_empty(&pwq->delayed_works); + drained = !pwq->nr_active && list_empty(&pwq->inactive_works); spin_unlock_irq(&pwq->pool->lock); if (drained) @@ -3703,7 +3703,7 @@ static void pwq_unbound_release_workfn(struct work_struct *work) * @pwq: target pool_workqueue * * If @pwq isn't freezing, set @pwq->max_active to the associated - * workqueue's saved_max_active and activate delayed work items + * workqueue's saved_max_active and activate inactive work items * accordingly. If @pwq is freezing, clear @pwq->max_active to zero. */ static void pwq_adjust_max_active(struct pool_workqueue *pwq) @@ -3732,9 +3732,9 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq) pwq->max_active = wq->saved_max_active; - while (!list_empty(&pwq->delayed_works) && + while (!list_empty(&pwq->inactive_works) && pwq->nr_active < pwq->max_active) { - pwq_activate_first_delayed(pwq); + pwq_activate_first_inactive(pwq); kick = true; } @@ -3765,7 +3765,7 @@ static void init_pwq(struct pool_workqueue *pwq, struct workqueue_struct *wq, pwq->wq = wq; pwq->flush_color = -1; pwq->refcnt = 1; - INIT_LIST_HEAD(&pwq->delayed_works); + INIT_LIST_HEAD(&pwq->inactive_works); INIT_LIST_HEAD(&pwq->pwqs_node); INIT_LIST_HEAD(&pwq->mayday_node); INIT_WORK(&pwq->unbound_release_work, pwq_unbound_release_workfn); @@ -4386,7 +4386,7 @@ void destroy_workqueue(struct workqueue_struct *wq) if (WARN_ON((pwq != wq->dfl_pwq) && (pwq->refcnt > 1)) || WARN_ON(pwq->nr_active) || - WARN_ON(!list_empty(&pwq->delayed_works))) { + WARN_ON(!list_empty(&pwq->inactive_works))) { mutex_unlock(&wq->mutex); show_workqueue_state(); return; @@ -4527,7 +4527,7 @@ bool workqueue_congested(int cpu, struct workqueue_struct *wq) else pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu)); - ret = !list_empty(&pwq->delayed_works); + ret = !list_empty(&pwq->inactive_works); rcu_read_unlock_sched(); return ret; @@ -4722,11 +4722,11 @@ static void show_pwq(struct pool_workqueue *pwq) pr_cont("\n"); } - if (!list_empty(&pwq->delayed_works)) { + if (!list_empty(&pwq->inactive_works)) { bool comma = false; - pr_info(" delayed:"); - list_for_each_entry(work, &pwq->delayed_works, entry) { + pr_info(" inactive:"); + list_for_each_entry(work, &pwq->inactive_works, entry) { pr_cont_work(comma, work); comma = !(*work_data_bits(work) & WORK_STRUCT_LINKED); } @@ -4756,7 +4756,7 @@ void show_workqueue_state(void) bool idle = true; for_each_pwq(pwq, wq) { - if (pwq->nr_active || !list_empty(&pwq->delayed_works)) { + if (pwq->nr_active || !list_empty(&pwq->inactive_works)) { idle = false; break; } @@ -4768,7 +4768,7 @@ void show_workqueue_state(void) for_each_pwq(pwq, wq) { spin_lock_irqsave(&pwq->pool->lock, flags); - if (pwq->nr_active || !list_empty(&pwq->delayed_works)) + if (pwq->nr_active || !list_empty(&pwq->inactive_works)) show_pwq(pwq); spin_unlock_irqrestore(&pwq->pool->lock, flags); /* @@ -5143,7 +5143,7 @@ EXPORT_SYMBOL_GPL(work_on_cpu_safe); * freeze_workqueues_begin - begin freezing workqueues * * Start freezing workqueues. After this function returns, all freezable - * workqueues will queue new works to their delayed_works list instead of + * workqueues will queue new works to their inactive_works list instead of * pool->worklist. * * CONTEXT: -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 0/4] Mainline bugfix patches backport
by Guo Mengqi 07 Aug '23

07 Aug '23

Backported 4 bugfix patches from mainline. Huang Shijie (1): lib/genalloc.c: change return type to unsigned long for bitmap_set_ll Saravana Kannan (1): driver core: Update device link status properly for device_bind_driver() Suravee Suthikulpanit (2): iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE iommu/amd: Restore IRTE.RemapEn bit after programming IRTE drivers/base/base.h | 1 + drivers/base/core.c | 35 ++++++++++++++++++++++++++++++++++ drivers/base/dd.c | 4 +++- drivers/iommu/Kconfig | 2 +- drivers/iommu/amd_iommu.c | 19 ++++++++++++++---- drivers/iommu/amd_iommu_init.c | 18 +++++++++++++++-- lib/genalloc.c | 3 ++- 7 files changed, 73 insertions(+), 9 deletions(-) -- 2.17.1

2 5

[PATCH OLK-5.10] netfilter: nft_set_pipapo: fix improper element removal
by Lu Wei 07 Aug '23

07 Aug '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.188 commit 3a91099ecd59a42d1632fcb152bf7222f268ea2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7P3TK CVE: CVE-2023-4004 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 87b5a5c209405cb6b57424cdfa226a6dbd349232 ] end key should be equal to start unless NFT_SET_EXT_KEY_END is present. Its possible to add elements that only have a start key ("{ 1.0.0.0 . 2.0.0.0 }") without an internval end. Insertion treats this via: if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END)) end = (const u8 *)nft_set_ext_key_end(ext)->data; else end = start; but removal side always uses nft_set_ext_key_end(). This is wrong and leads to garbage remaining in the set after removal next lookup/insert attempt will give: BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90 Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399 Call Trace: kasan_report+0x105/0x140 pipapo_get+0x8eb/0xb90 nft_pipapo_insert+0x1dc/0x1710 nf_tables_newsetelem+0x31f5/0x4e00 .. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: lonial con <kongln9170(a)gmail.com> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 30cf0673d6c1..4781cdb63431 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1904,7 +1904,11 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, int i, start, rules_fx; match_start = data; - match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data; + + if (nft_set_ext_exists(&e->ext, NFT_SET_EXT_KEY_END)) + match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data; + else + match_end = data; start = first_rule; rules_fx = rules_f0; -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-pci: fix page size checks
by Yong Hu 07 Aug '23

07 Aug '23

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v5.10.188 commit cc512539c44f173c2a5fc967e4feb0043bc5773d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 841734234a28fd5cd0889b84bd4d93a0988fa11e ] The size allocated out of the dma pool is at most NVME_CTRL_PAGE_SIZE, which may be smaller than the PAGE_SIZE. Fixes: c61b82c7b7134 ("nvme-pci: fix PRP pool size") Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index ef2fcd0ed914..f1ac50c7a1d6 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -33,7 +33,7 @@ #define SQ_SIZE(q) ((q)->q_depth << (q)->sqes) #define CQ_SIZE(q) ((q)->q_depth * sizeof(struct nvme_completion)) -#define SGES_PER_PAGE (PAGE_SIZE / sizeof(struct nvme_sgl_desc)) +#define SGES_PER_PAGE (NVME_CTRL_PAGE_SIZE / sizeof(struct nvme_sgl_desc)) /* * These can be higher, but we need to ensure that any command doesn't @@ -374,7 +374,7 @@ static int nvme_pci_npages_prp(void) { unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); - return DIV_ROUND_UP(8 * nprps, PAGE_SIZE - 8); + return DIV_ROUND_UP(8 * nprps, NVME_CTRL_PAGE_SIZE - 8); } /* @@ -384,7 +384,7 @@ static int nvme_pci_npages_prp(void) static int nvme_pci_npages_sgl(void) { return DIV_ROUND_UP(NVME_MAX_SEGS * sizeof(struct nvme_sgl_desc), - PAGE_SIZE); + NVME_CTRL_PAGE_SIZE); } static size_t nvme_pci_iod_alloc_size(void) @@ -735,7 +735,7 @@ static void nvme_pci_sgl_set_seg(struct nvme_sgl_desc *sge, sge->length = cpu_to_le32(entries * sizeof(*sge)); sge->type = NVME_SGL_FMT_LAST_SEG_DESC << 4; } else { - sge->length = cpu_to_le32(PAGE_SIZE); + sge->length = cpu_to_le32(NVME_CTRL_PAGE_SIZE); sge->type = NVME_SGL_FMT_SEG_DESC << 4; } } -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-pci: fix mempool alloc size
by Yong Hu 07 Aug '23

07 Aug '23

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v5.10.188 commit dfb6d54893d544151e7f480bc44cfe7823f5ad23 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… [ Upstream commit c89a529e823d51dd23c7ec0c047c7a454a428541 ] Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool. While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence. Cc: Jens Axboe <axboe(a)kernel.dk> Fixes: 943e942e6266f ("nvme-pci: limit max IO size and segments to avoid high order allocations") Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 510ce0c145c7..ef2fcd0ed914 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -372,8 +372,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, */ static int nvme_pci_npages_prp(void) { - unsigned nprps = DIV_ROUND_UP(NVME_MAX_KB_SZ + NVME_CTRL_PAGE_SIZE, - NVME_CTRL_PAGE_SIZE); + unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE; + unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE); return DIV_ROUND_UP(8 * nprps, PAGE_SIZE - 8); } -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-pci: fix doorbell buffer value endianness
by Yong Hu 07 Aug '23

07 Aug '23

From: Klaus Jensen <k.jensen(a)samsung.com> stable inclusion from stable-v5.10.188 commit f5d8738fbe33e71959b5a69221ecf515032d3fc7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit b5f96cb719d8ba220b565ddd3ba4ac0d8bcfb130 ] When using shadow doorbells, the event index and the doorbell values are written to host memory. Prior to this patch, the values written would erroneously be written in host endianness. This causes trouble on big-endian platforms. Fix this by adding missing endian conversions. This issue was noticed by Guenter while testing various big-endian platforms under QEMU[1]. A similar fix required for hw/nvme in QEMU is up for review as well[2]. [1]: https://lore.kernel.org/qemu-devel/20221209110022.GA3396194@roeck-us.net/ [2]: https://lore.kernel.org/qemu-devel/20221212114409.34972-4-its@irrelevant.dk/ Fixes: f9f38e33389c ("nvme: improve performance for virtual NVMe devices") Reported-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Klaus Jensen <k.jensen(a)samsung.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 72fe56857cb0..510ce0c145c7 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -139,9 +139,9 @@ struct nvme_dev { mempool_t *iod_mempool; /* shadow doorbell buffer support: */ - u32 *dbbuf_dbs; + __le32 *dbbuf_dbs; dma_addr_t dbbuf_dbs_dma_addr; - u32 *dbbuf_eis; + __le32 *dbbuf_eis; dma_addr_t dbbuf_eis_dma_addr; /* host memory buffer support: */ @@ -209,10 +209,10 @@ struct nvme_queue { #define NVMEQ_SQ_CMB 1 #define NVMEQ_DELETE_ERROR 2 #define NVMEQ_POLLED 3 - u32 *dbbuf_sq_db; - u32 *dbbuf_cq_db; - u32 *dbbuf_sq_ei; - u32 *dbbuf_cq_ei; + __le32 *dbbuf_sq_db; + __le32 *dbbuf_cq_db; + __le32 *dbbuf_sq_ei; + __le32 *dbbuf_cq_ei; struct completion delete_done; }; @@ -334,11 +334,11 @@ static inline int nvme_dbbuf_need_event(u16 event_idx, u16 new_idx, u16 old) } /* Update dbbuf and return true if an MMIO is required */ -static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db, - volatile u32 *dbbuf_ei) +static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db, + volatile __le32 *dbbuf_ei) { if (dbbuf_db) { - u16 old_value; + u16 old_value, event_idx; /* * Ensure that the queue is written before updating @@ -346,8 +346,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db, */ wmb(); - old_value = *dbbuf_db; - *dbbuf_db = value; + old_value = le32_to_cpu(*dbbuf_db); + *dbbuf_db = cpu_to_le32(value); /* * Ensure that the doorbell is updated before reading the event @@ -357,7 +357,8 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db, */ mb(); - if (!nvme_dbbuf_need_event(*dbbuf_ei, value, old_value)) + event_idx = le32_to_cpu(*dbbuf_ei); + if (!nvme_dbbuf_need_event(event_idx, value, old_value)) return false; } -- 2.34.1

2 1

[OLK-5.10] netfilter: nft_set_pipapo: fix improper element removal
by Lu Wei 07 Aug '23

07 Aug '23

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.188 commit 3a91099ecd59a42d1632fcb152bf7222f268ea2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7P3TK CVE: CVE-2023-4004 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 87b5a5c209405cb6b57424cdfa226a6dbd349232 ] end key should be equal to start unless NFT_SET_EXT_KEY_END is present. Its possible to add elements that only have a start key ("{ 1.0.0.0 . 2.0.0.0 }") without an internval end. Insertion treats this via: if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END)) end = (const u8 *)nft_set_ext_key_end(ext)->data; else end = start; but removal side always uses nft_set_ext_key_end(). This is wrong and leads to garbage remaining in the set after removal next lookup/insert attempt will give: BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90 Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399 Call Trace: kasan_report+0x105/0x140 pipapo_get+0x8eb/0xb90 nft_pipapo_insert+0x1dc/0x1710 nf_tables_newsetelem+0x31f5/0x4e00 .. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: lonial con <kongln9170(a)gmail.com> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 30cf0673d6c1..4781cdb63431 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1904,7 +1904,11 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, int i, start, rules_fx; match_start = data; - match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data; + + if (nft_set_ext_exists(&e->ext, NFT_SET_EXT_KEY_END)) + match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data; + else + match_end = data; start = first_rule; rules_fx = rules_f0; -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] sched: disable sched_autogroup by default
by Jialin Zhang 07 Aug '23

07 Aug '23

hulk inclusion category: performance bugzilla: 32059, https://gitee.com/openeuler/kernel/issues/I65DOZ CVE: NA -------------------------------- This option optimizes the scheduler for common desktop workloads by automatically creating and populating task groups. This separation of workloads isolates aggressive CPU burners (like build jobs) from desktop applications. Task group autogeneration is currently based upon task session. We do not need this for mostly server workloads, so just disable by default. If you need this feature really, just enable it by sysctl: sysctl -w kernel.sched_autogroup_enabled=1 Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/sched/autogroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/autogroup.c b/kernel/sched/autogroup.c index 2d4ff5353ded..640d4019deac 100644 --- a/kernel/sched/autogroup.c +++ b/kernel/sched/autogroup.c @@ -5,7 +5,7 @@ #include <linux/nospec.h> #include "sched.h" -unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; +unsigned int __read_mostly sysctl_sched_autogroup_enabled; static struct autogroup autogroup_default; static atomic_t autogroup_seq_nr; -- 2.25.1

2 1

[PATCH OLK-5.10] tty: fix pid memleak in disassociate_ctty()
by Yi Yang 07 Aug '23

07 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7LEZX -------------------------------- There is memleak in alloc_pid: ------------------------------ unreferenced object 0xffff88810c181940 (size 224): comm "sshd", pid 8191, jiffies 4294946950 (age 524.570s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff ....kkkk........ backtrace: [<ffffffff814774e6>] kmem_cache_alloc+0x5c6/0x9b0 [<ffffffff81177342>] alloc_pid+0x72/0x570 [<ffffffff81140ac4>] copy_process+0x1374/0x2470 [<ffffffff81141d77>] kernel_clone+0xb7/0x900 [<ffffffff81142645>] __se_sys_clone+0x85/0xb0 [<ffffffff8114269b>] __x64_sys_clone+0x2b/0x30 [<ffffffff83965a72>] do_syscall_64+0x32/0x80 [<ffffffff83a00085>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 The pid memleak is triggered by the following race: task[sshd] task[bash] ----------------------- ----------------------- do_exit(); disassociate_ctty(); spin_lock_irq(¤t->sighand->siglock); put_pid(current->signal->tty_old_pgrp); current->signal->tty_old_pgrp = NULL; tty = tty_kref_get(current->signal->tty); //tty is not NULL spin_unlock_irq(¤t->sighand->siglock); tty_vhangup(); tty_lock(tty); ... tty_signal_session_leader(); spin_lock_irq(&p->sighand->siglock); ... p->signal->tty_old_pgrp = get_pid(tty->pgrp); // tty_old_pgrp reassign spin_unlock_irq(&p->sighand->siglock); ... tty_unlock(tty); if (tty) { tty_lock(tty); ... put_pid(tty->pgrp); tty->pgrp = NULL;// It's too late ... tty_unlock(tty); } in task[bash], tty_old_pgrp is released by disassociate_ctty(), then it's reassigned by tty_signal_session_leader() in task[sshd], cause memleak. fix the memleak by add put_pid() in disassociate_ctty() after tty_old_pgrp is reassigned. Fixes: c8bcd9c5be24 ("tty: Fix ->session locking") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/tty_jobctrl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c index aa6d0537b379..56c791c81b4f 100644 --- a/drivers/tty/tty_jobctrl.c +++ b/drivers/tty/tty_jobctrl.c @@ -308,6 +308,18 @@ void disassociate_ctty(int on_exit) spin_unlock_irqrestore(&tty->ctrl_lock, flags); tty_unlock(tty); tty_kref_put(tty); + + /* + * Race with tty_signal_session_leader(), current->signal + * ->tty_old_pgrp may be reassigned, put_pid() again to ensure + * the pid does not leak memory. + */ + if (on_exit) { + spin_lock_irq(&current->sighand->siglock); + put_pid(current->signal->tty_old_pgrp); + current->signal->tty_old_pgrp = NULL; + spin_unlock_irq(&current->sighand->siglock); + } } /* Now clear signal->tty under the lock */ -- 2.17.1

2 1

[PATCH OLK-5.10] nvme-pci: fix timeout request state check
by Yong Hu 07 Aug '23

07 Aug '23

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v5.10.188 commit 5f10f7efe0fc97c0ee2112a1032914f6fb2f940c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R4BC CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1c5842085851f786eba24a39ecd02650ad892064 ] Polling the completion can progress the request state to IDLE, either inline with the completion, or through softirq. Either way, the state may not be COMPLETED, so don't check for that. We only care if the state isn't IN_FLIGHT. This is fixing an issue where the driver aborts an IO that we just completed. Seeing the "aborting" message instead of "polled" is very misleading as to where the timeout problem resides. Fixes: bf392a5dc02a9b ("nvme-pci: Remove tag from process cq") Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 8965ea20f5ef..72fe56857cb0 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -1291,7 +1291,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved) else nvme_poll_irqdisable(nvmeq); - if (blk_mq_request_completed(req)) { + if (blk_mq_rq_state(req) != MQ_RQ_IN_FLIGHT) { dev_warn(dev->ctrl.device, "I/O %d QID %d timeout, completion polled\n", req->tag, nvmeq->qid); -- 2.34.1

2 1

[PATCH openEuler-23.09 0/8] arm64: Add framework to turn an IPI as NMI
by Ruan Jinjie 07 Aug '23

07 Aug '23

arm64: Add framework to turn an IPI as NMI Sumit Garg (7): arm64: Add framework to turn IPI as NMI irqchip/gic-v3: Enable support for SGIs to act as NMIs arm64: smp: Assign and setup an IPI as NMI nmi: backtrace: Allow runtime arch specific override arm64: ipi_nmi: Add support for NMI backtrace kgdb: Expose default CPUs roundup fallback mechanism arm64: kgdb: Roundup cpus using IPI as NMI Xiongfeng Wang (1): arm64: ipi_nmi: fix compile error when CONFIG_KGDB is disabled arch/arm/include/asm/irq.h | 2 +- arch/arm/kernel/smp.c | 3 +- arch/arm64/include/asm/irq.h | 6 +++ arch/arm64/include/asm/nmi.h | 17 +++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/ipi_nmi.c | 85 ++++++++++++++++++++++++++++++++ arch/arm64/kernel/kgdb.c | 18 +++++++ arch/arm64/kernel/smp.c | 8 +++ arch/mips/include/asm/irq.h | 2 +- arch/mips/kernel/process.c | 3 +- arch/powerpc/include/asm/nmi.h | 2 +- arch/powerpc/kernel/stacktrace.c | 3 +- arch/sparc/include/asm/irq_64.h | 2 +- arch/sparc/kernel/process_64.c | 4 +- arch/x86/include/asm/irq.h | 2 +- arch/x86/kernel/apic/hw_nmi.c | 3 +- drivers/irqchip/irq-gic-v3.c | 29 ++++++++--- include/linux/kgdb.h | 12 +++++ include/linux/nmi.h | 12 ++--- kernel/debug/debug_core.c | 8 ++- 20 files changed, 195 insertions(+), 28 deletions(-) create mode 100644 arch/arm64/include/asm/nmi.h create mode 100644 arch/arm64/kernel/ipi_nmi.c -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS] tty: fix pid memleak in disassociate_ctty()
by Yi Yang 07 Aug '23

07 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PBYJ -------------------------------- There is memleak in alloc_pid: ------------------------------ unreferenced object 0xffff88810c181940 (size 224): comm "sshd", pid 8191, jiffies 4294946950 (age 524.570s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff ....kkkk........ backtrace: [<ffffffff814774e6>] kmem_cache_alloc+0x5c6/0x9b0 [<ffffffff81177342>] alloc_pid+0x72/0x570 [<ffffffff81140ac4>] copy_process+0x1374/0x2470 [<ffffffff81141d77>] kernel_clone+0xb7/0x900 [<ffffffff81142645>] __se_sys_clone+0x85/0xb0 [<ffffffff8114269b>] __x64_sys_clone+0x2b/0x30 [<ffffffff83965a72>] do_syscall_64+0x32/0x80 [<ffffffff83a00085>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 The pid memleak is triggered by the following race: task[sshd] task[bash] ----------------------- ----------------------- do_exit(); disassociate_ctty(); spin_lock_irq(¤t->sighand->siglock); put_pid(current->signal->tty_old_pgrp); current->signal->tty_old_pgrp = NULL; tty = tty_kref_get(current->signal->tty); //tty is not NULL spin_unlock_irq(¤t->sighand->siglock); tty_vhangup(); tty_lock(tty); ... tty_signal_session_leader(); spin_lock_irq(&p->sighand->siglock); ... p->signal->tty_old_pgrp = get_pid(tty->pgrp); // tty_old_pgrp reassign spin_unlock_irq(&p->sighand->siglock); ... tty_unlock(tty); if (tty) { tty_lock(tty); ... put_pid(tty->pgrp); tty->pgrp = NULL;// It's too late ... tty_unlock(tty); } in task[bash], tty_old_pgrp is released by disassociate_ctty(), then it's reassigned by tty_signal_session_leader() in task[sshd], cause memleak. fix the memleak by add put_pid() in disassociate_ctty() after tty_old_pgrp is reassigned. Fixes: c8bcd9c5be24 ("tty: Fix ->session locking") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/tty_jobctrl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c index ffcab80ba77d..e04360de3757 100644 --- a/drivers/tty/tty_jobctrl.c +++ b/drivers/tty/tty_jobctrl.c @@ -308,6 +308,18 @@ void disassociate_ctty(int on_exit) spin_unlock_irqrestore(&tty->ctrl_lock, flags); tty_unlock(tty); tty_kref_put(tty); + + /* + * Race with tty_signal_session_leader(), current->signal + * ->tty_old_pgrp may be reassigned, put_pid() again to ensure + * the pid does not leak memory. + */ + if (on_exit) { + spin_lock_irq(&current->sighand->siglock); + put_pid(current->signal->tty_old_pgrp); + current->signal->tty_old_pgrp = NULL; + spin_unlock_irq(&current->sighand->siglock); + } } /* Now clear signal->tty under the lock */ -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 07 Aug '23

07 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-23.09 0/8] arm64: Add framework to turn an IPI as NMI
by Ruan Jinjie 07 Aug '23

07 Aug '23

arm64: Add framework to turn an IPI as NMI Sumit Garg (7): arm64: Add framework to turn IPI as NMI irqchip/gic-v3: Enable support for SGIs to act as NMIs arm64: smp: Assign and setup an IPI as NMI nmi: backtrace: Allow runtime arch specific override arm64: ipi_nmi: Add support for NMI backtrace kgdb: Expose default CPUs roundup fallback mechanism arm64: kgdb: Roundup cpus using IPI as NMI Xiongfeng Wang (1): arm64: ipi_nmi: fix compile error when CONFIG_KGDB is disabled arch/arm/include/asm/irq.h | 2 +- arch/arm/kernel/smp.c | 3 +- arch/arm64/include/asm/irq.h | 6 +++ arch/arm64/include/asm/nmi.h | 17 +++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/ipi_nmi.c | 85 ++++++++++++++++++++++++++++++++ arch/arm64/kernel/kgdb.c | 18 +++++++ arch/arm64/kernel/smp.c | 8 +++ arch/mips/include/asm/irq.h | 2 +- arch/mips/kernel/process.c | 3 +- arch/powerpc/include/asm/nmi.h | 2 +- arch/powerpc/kernel/stacktrace.c | 3 +- arch/sparc/include/asm/irq_64.h | 2 +- arch/sparc/kernel/process_64.c | 4 +- arch/x86/include/asm/irq.h | 2 +- arch/x86/kernel/apic/hw_nmi.c | 3 +- drivers/irqchip/irq-gic-v3.c | 29 ++++++++--- include/linux/kgdb.h | 12 +++++ include/linux/nmi.h | 12 ++--- kernel/debug/debug_core.c | 8 ++- 20 files changed, 195 insertions(+), 28 deletions(-) create mode 100644 arch/arm64/include/asm/nmi.h create mode 100644 arch/arm64/kernel/ipi_nmi.c -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 07 Aug '23

07 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 07 Aug '23

07 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3