- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10-LTS 1/2] Bluetooth: L2CAP: Fix attempting to access uninitialized memory
by Zheng Zengkai 23 Nov '22

23 Nov '22

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.154 commit 26ca2ac091b49281d73df86111d16e5a76e43bd7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5ZNRS CVE: CVE-2022-42895 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b1a2cd50c0357f243b7435a732b4e62ba3157a2e upstream. On l2cap_parse_conf_req the variable efs is only initialized if remote_efs has been set. CVE: CVE-2022-42895 CC: stable(a)vger.kernel.org Reported-by: Tamás Koczka <poprdi(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Reviewed-by: Tedd Ho-Jeong An <tedd.an(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 584a9deb8c80..d35b168e7793 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3758,7 +3758,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), (unsigned long) &rfc, endptr - ptr); - if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { + if (remote_efs && + test_bit(FLAG_EFS_ENABLE, &chan->flags)) { chan->remote_id = efs.id; chan->remote_stype = efs.stype; chan->remote_msdu = le16_to_cpu(efs.msdu); -- 2.20.1

1 1

[PATCH OLK-5.10 v4] mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64
by Zheng Zengkai 23 Nov '22

23 Nov '22

openeuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/intel-kernel/issues/I5RQLJ CVE: NA Intel-SIG: mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64. -------------------------------- Use the KABI_DEPRECATE and KABI_USE macro to fix kabi change caused by commit 1c33bb050750 ("x86/elf: Support a new ELF aux vector AT_MINSIGSTKSZ"). The extended saved_auxv[] causes the kabi breakage, move the saved_auxv[] to the end of struct mm_struct. To avoid introducing too many size increase of mm_struct, use a pointer to indirectly reference the relocated saved_auxv[], then adapt the code where mm->saved_auxv is used. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Lin Wang <lin.x.wang(a)intel.com> Signed-off-by: Aichun Shi <aichun.shi(a)intel.com> --- arch/x86/include/uapi/asm/auxvec.h | 2 ++ fs/binfmt_elf.c | 12 ++++---- fs/binfmt_elf_fdpic.c | 2 +- fs/proc/base.c | 6 ++-- include/linux/mm_types.h | 30 ++++++++++++++++++++ kernel/fork.c | 44 ++++++++++++++++++++++++++---- kernel/sys.c | 10 +++---- 7 files changed, 86 insertions(+), 20 deletions(-) diff --git a/arch/x86/include/uapi/asm/auxvec.h b/arch/x86/include/uapi/asm/auxvec.h index 6beb55bbefa4..6be5f6584119 100644 --- a/arch/x86/include/uapi/asm/auxvec.h +++ b/arch/x86/include/uapi/asm/auxvec.h @@ -13,8 +13,10 @@ /* entries in ARCH_DLINFO: */ #if defined(CONFIG_IA32_EMULATION) || !defined(CONFIG_X86_64) # define AT_VECTOR_SIZE_ARCH 3 +# define ORIG_AT_VECTOR_SIZE_ARCH 2 #else /* else it's non-compat x86-64 */ # define AT_VECTOR_SIZE_ARCH 2 +# define ORIG_AT_VECTOR_SIZE_ARCH 1 #endif #endif /* _ASM_X86_AUXVEC_H */ diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index ed507d27034b..8e56bb649f0e 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -236,7 +236,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, return -EFAULT; /* Create the ELF interpreter info */ - elf_info = (elf_addr_t *)mm->saved_auxv; + elf_info = (elf_addr_t *)MM_SAVED_AUXV(mm); /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ #define NEW_AUX_ENT(id, val) \ do { \ @@ -285,13 +285,13 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, } #undef NEW_AUX_ENT /* AT_NULL is zero; clear the rest too */ - memset(elf_info, 0, (char *)mm->saved_auxv + - sizeof(mm->saved_auxv) - (char *)elf_info); + memset(elf_info, 0, (char *)MM_SAVED_AUXV(mm) + + sizeof(MM_SAVED_AUXV(mm)) - (char *)elf_info); /* And advance past the AT_NULL entry. */ elf_info += 2; - ei_index = elf_info - (elf_addr_t *)mm->saved_auxv; + ei_index = elf_info - (elf_addr_t *)MM_SAVED_AUXV(mm); sp = STACK_ADD(p, ei_index); items = (argc + 1) + (envc + 1) + 1; @@ -352,7 +352,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, mm->env_end = p; /* Put the elf_info on the stack in the right place. */ - if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t))) + if (copy_to_user(sp, MM_SAVED_AUXV(mm), ei_index * sizeof(elf_addr_t))) return -EFAULT; return 0; } @@ -1586,7 +1586,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) { - elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; + elf_addr_t *auxv = (elf_addr_t *) MM_SAVED_AUXV(mm); int i = 0; do i += 2; diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c index be4062b8ba75..06d45339676f 100644 --- a/fs/binfmt_elf_fdpic.c +++ b/fs/binfmt_elf_fdpic.c @@ -1550,7 +1550,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) fill_note(&psinfo_note, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); thread_status_size += notesize(&psinfo_note); - auxv = (elf_addr_t *) current->mm->saved_auxv; + auxv = (elf_addr_t *) current->MM_SAVED_AUXV(mm); i = 0; do i += 2; diff --git a/fs/proc/base.c b/fs/proc/base.c index cc1fdff2e136..fe2633176ed5 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1038,9 +1038,9 @@ static ssize_t auxv_read(struct file *file, char __user *buf, return 0; do { nwords += 2; - } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */ - return simple_read_from_buffer(buf, count, ppos, mm->saved_auxv, - nwords * sizeof(mm->saved_auxv[0])); + } while (MM_SAVED_AUXV(mm)[nwords - 2] != 0); /* AT_NULL */ + return simple_read_from_buffer(buf, count, ppos, MM_SAVED_AUXV(mm), + nwords * sizeof(MM_SAVED_AUXV(mm)[0])); } static const struct file_operations proc_auxv_operations = { diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 15ff1e20f5ca..ba69c5ecd4ce 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -24,6 +24,21 @@ #endif #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) +#define _MM_STRUCT_SIZE (sizeof(struct mm_struct) + cpumask_size()) + +#if defined(CONFIG_X86_64) + #define ORIG_AT_VECTOR_SIZE (2*(ORIG_AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) + #define MM_SAVED_AUXV(mm) mm->mm_extend->saved_auxv + #define MM_STRUCT_SIZE (_MM_STRUCT_SIZE + sizeof(struct mm_struct_extend)) + #define OFFSET_OF_MM_SAVED_AUXV (_MM_STRUCT_SIZE + offsetof(struct mm_struct_extend, saved_auxv)) + #define SIZE_OF_MM_SAVED_AUXV sizeof_field(struct mm_struct_extend, saved_auxv) +#else + #define MM_SAVED_AUXV(mm) mm->saved_auxv + #define MM_STRUCT_SIZE _MM_STRUCT_SIZE + #define OFFSET_OF_MM_SAVED_AUXV offsetof(struct mm_struct, saved_auxv) + #define SIZE_OF_MM_SAVED_AUXV sizeof_field(struct mm_struct, saved_auxv) +#endif + #define INIT_PASID 0 struct address_space; @@ -394,6 +409,13 @@ struct core_state { }; struct kioctx_table; + +#if defined(CONFIG_X86_64) +struct mm_struct_extend { + unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */ +}; +#endif + struct mm_struct { struct { struct vm_area_struct *mmap; /* list of VMAs */ @@ -508,7 +530,11 @@ struct mm_struct { unsigned long start_brk, brk, start_stack; unsigned long arg_start, arg_end, env_start, env_end; +#if defined(CONFIG_X86_64) + KABI_DEPRECATE(unsigned long, saved_auxv[ORIG_AT_VECTOR_SIZE]) +#else unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */ +#endif /* * Special counters, in some configurations protected by the @@ -592,7 +618,11 @@ struct mm_struct { #endif } __randomize_layout; +#if defined(CONFIG_X86_64) + KABI_USE(1, struct mm_struct_extend *mm_extend) +#else KABI_RESERVE(1) +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) diff --git a/kernel/fork.c b/kernel/fork.c index 8a40bfda35e1..c2f13f635135 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1088,6 +1088,21 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, return NULL; } +static inline void mm_struct_clear(struct mm_struct *mm) +{ + memset(mm, 0, sizeof(*mm)); + +#if (defined(CONFIG_X86_64)) + /* + * init the mm_struct_extend extra area at the bottom of + * the allocated mm struct and reset mm->mm_extend accordingly. + */ + memset((void *)((unsigned long) mm + _MM_STRUCT_SIZE), + 0, sizeof(struct mm_struct_extend)); + mm->mm_extend = (struct mm_struct_extend *)((unsigned long) mm + _MM_STRUCT_SIZE); +#endif +} + /* * Allocate and initialize an mm_struct. */ @@ -1099,7 +1114,8 @@ struct mm_struct *mm_alloc(void) if (!mm) return NULL; - memset(mm, 0, sizeof(*mm)); + mm_struct_clear(mm); + return mm_init(mm, current, current_user_ns()); } @@ -1382,6 +1398,24 @@ void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm) mm_release(tsk, mm); } +static inline void mm_struct_copy(struct mm_struct *mm, struct mm_struct *oldmm) +{ + memcpy(mm, oldmm, sizeof(*mm)); + +#if defined(CONFIG_X86_64) + /* + * copy the mm_struct_extend extra area at the bottom of + * the oldmm slab object over to the newly allocated mm struct, + * and reset mm->mm_extend accordingly. + */ + memcpy((void *)((unsigned long) mm + _MM_STRUCT_SIZE), + (void *)((unsigned long) oldmm + _MM_STRUCT_SIZE), + sizeof(struct mm_struct_extend)); + + mm->mm_extend = (struct mm_struct_extend *)((unsigned long) mm + _MM_STRUCT_SIZE); +#endif +} + /** * dup_mm() - duplicates an existing mm structure * @tsk: the task_struct with which the new mm will be associated. @@ -1402,7 +1436,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk, if (!mm) goto fail_nomem; - memcpy(mm, oldmm, sizeof(*mm)); + mm_struct_copy(mm, oldmm); if (!mm_init(mm, tsk, mm->user_ns)) goto fail_nomem; @@ -2872,13 +2906,13 @@ void __init proc_caches_init(void) * dynamically sized based on the maximum CPU number this system * can have, taking hotplug into account (nr_cpu_ids). */ - mm_size = sizeof(struct mm_struct) + cpumask_size(); + mm_size = MM_STRUCT_SIZE; mm_cachep = kmem_cache_create_usercopy("mm_struct", mm_size, ARCH_MIN_MMSTRUCT_ALIGN, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, - offsetof(struct mm_struct, saved_auxv), - sizeof_field(struct mm_struct, saved_auxv), + OFFSET_OF_MM_SAVED_AUXV, + SIZE_OF_MM_SAVED_AUXV, NULL); vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT); mmap_init(); diff --git a/kernel/sys.c b/kernel/sys.c index c8a31e1037be..10c5a6d2acdc 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1962,7 +1962,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data struct mm_struct *mm = current->mm; int error; - BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); + BUILD_BUG_ON(sizeof(user_auxv) != sizeof(MM_SAVED_AUXV(mm))); BUILD_BUG_ON(sizeof(struct prctl_mm_map) > 256); if (opt == PR_SET_MM_MAP_SIZE) @@ -1984,7 +1984,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data * Someone is trying to cheat the auxv vector. */ if (!prctl_map.auxv || - prctl_map.auxv_size > sizeof(mm->saved_auxv)) + prctl_map.auxv_size > sizeof(MM_SAVED_AUXV(mm))) return -EINVAL; memset(user_auxv, 0, sizeof(user_auxv)); @@ -2056,7 +2056,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data * more complex. */ if (prctl_map.auxv_size) - memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv)); + memcpy(MM_SAVED_AUXV(mm), user_auxv, sizeof(user_auxv)); mmap_read_unlock(mm); return 0; @@ -2084,10 +2084,10 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr, user_auxv[AT_VECTOR_SIZE - 2] = 0; user_auxv[AT_VECTOR_SIZE - 1] = 0; - BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); + BUILD_BUG_ON(sizeof(user_auxv) != sizeof(MM_SAVED_AUXV(mm))); task_lock(current); - memcpy(mm->saved_auxv, user_auxv, len); + memcpy(MM_SAVED_AUXV(mm), user_auxv, len); task_unlock(current); return 0; -- 2.20.1

1 0

[PATCH openEuler-5.10 01/81] Revert "block/wbt: fix negative inflight counter when remove scsi device"
by Zheng Zengkai 21 Nov '22

21 Nov '22

From: Li Nan <linan122(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187584, https://gitee.com/openeuler/kernel/issues/I5QW2R CVE: NA -------------------------------- This reverts commit 37838982c0e97898780682980aaf10755625630e. There are two wbt_enable_default() in bfq_exit_queue(). Although it will not lead to no fault, revert one. Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/bfq-iosched.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 4bfea5e5354e..1aec01c0a707 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -6418,8 +6418,6 @@ static void bfq_exit_queue(struct elevator_queue *e) spin_unlock_irq(&bfqd->lock); #endif - wbt_enable_default(bfqd->queue); - kfree(bfqd); /* Re-enable throttling in case elevator disabled it */ -- 2.20.1

1 80

[openEuler-5.10 000/150] Backport 5.10.138 LTS
by Zheng Zengkai 21 Nov '22

21 Nov '22

Backport 5.10.138 LTS patches from upstream. git cherry-pick v5.10.137..v5.10.138~1 -s Already merged(-6): 0e28678a770d devlink: Fix use-after-free after a failed reload 38ddccbda5e8 vsock: Fix memory leak in vsock_connect() a0ae122e9aec atm: idt77252: fix use-after-free bugs caused by tst_timer a220ff343396 can: j1939: j1939_session_destroy(): fix memory leak of skbs 3527e3cbb84d bpf: Fix KASAN use-after-free Read in compute_effective_progs 1daa7629d2a2 PCI/ERR: Retain status from error notification Context conflict： 63671b2bdf5f watchdog: export lockup_detector_reconfigure Defered for performance degradation(-1): 823280a8fba3 locking/atomic: Make test_and_*_bit() ordered on failure Total patches: 157 - 6 - 1 = 150 Aaron Lu (1): x86/mm: Use proper mask when setting PUD mapping Al Viro (6): nios2: page fault et.al. are *not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() Alan Brady (1): i40e: Fix to stop tx_timeout recovery if GLOBR fails Amadeusz Sławiński (1): ALSA: info: Fix llseek return value when using callback Amelie Delaunay (1): usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch Andrew Donnellan (1): gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file Andy Shevchenko (1): pinctrl: intel: Check against matching data instead of ACPI companion Arun Ramadoss (1): net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry Bard Liao (1): ASoC: SOF: intel: move sof_intel_dsp_desc() forward Bob Pearson (1): RDMA/rxe: Limit the number of calls to each tasklet Celeste Liu (1): riscv: mmap with PROT_WRITE but no PROT_READ is invalid Chao Yu (2): f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() f2fs: fix to do sanity check on segment type in build_sit_entries() Chen Lin (1): dpaa2-eth: trace the allocated address instead of page struct Chia-Lin Kao (AceLan) (1): net: atlantic: fix aq_vec index out of range error Christoffer Sandberg (1): ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU Christophe JAILLET (6): mmc: pxamci: Fix another error handling path in pxamci_probe() mmc: pxamci: Fix an error handling path in pxamci_probe() mmc: meson-gx: Fix an error handling path in meson_mmc_probe() perf probe: Fix an error handling path in 'parse_perf_probe_command()' stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() cxl: Fix a memory leak in an error handling path Christophe Leroy (1): powerpc/32: Don't always pass -mcpu=powerpc to the compiler Csókás Bence (1): fec: Fix timer capture timing in `fec_ptp_enable_pps()` Damien Le Moal (1): ata: libata-eh: Add missing command name Dan Aloni (1): sunrpc: fix expiry of auth creds Dan Carpenter (3): NTB: ntb_tool: uninitialized heap data in tool_fn_write() xen/xenbus: fix return type in xenbus_file_read() netfilter: nftables: fix a warning message in nf_tables_commit_audit_collect() Dmitry Baryshkov (1): dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources Dongliang Mu (1): netfilter: nf_tables: fix audit memory leak in nf_tables_commit Fedor Pchelkin (1): can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() Filipe Manana (1): btrfs: fix lost error handling when looking up extended ref on log replay Florian Westphal (1): plip: avoid rcu debug splat Frank Li (1): usb: cdns3 fix use-after-free at workaround 2 Frieder Schrempf (1): regulator: pca9450: Remove restrictions for regulator-name Grzegorz Siwik (1): ice: Ignore EEXIST when setting promisc mode Guenter Roeck (1): lib/list_debug.c: Detect uninitialized lists Helge Deller (1): modules: Ensure natural alignment for .altinstructions and __bug_table sections Hou Tao (5): bpf: Acquire map uref in .init_seq_private for array map iterator bpf: Acquire map uref in .init_seq_private for hash map iterator bpf: Acquire map uref in .init_seq_private for sock local storage map iterator bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator bpf: Check the validity of max_rdwr_access for sock local storage map iterator Huacai Chen (1): PCI/ACPI: Guard ARM64-specific mcfg_quirks Jakub Kicinski (1): net: genl: fix error path memory leak in policy dumping James Smart (1): scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Jason A. Donenfeld (1): um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups Jean-Philippe Brucker (1): uacce: Handle parent device removal or parent driver module rmmod Jeff Layton (1): ceph: don't leak snap_rwsem in handle_cap_grant Jens Wiklander (1): tee: fix memory leak in tee_shm_register() Jianhua Lu (1): pinctrl: qcom: sm8250: Fix PDC map John Johansen (5): apparmor: fix quiet_denied for file rules apparmor: fix absroot causing audited secids to begin with = apparmor: Fix failed mount permission check error message apparmor: fix setting unconfined mode on a loaded profile apparmor: fix overlapping attachment computation Jozef Martiniak (1): gadgetfs: ep_io - wait until IRQ finishes Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Krzysztof Kozlowski (1): dt-bindings: arm: qcom: fix MSM8916 MTP compatibles Laurent Dufour (1): watchdog: export lockup_detector_reconfigure Liang He (5): drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() usb: host: ohci-ppc-of: Fix refcount leak bug usb: renesas: Fix refcount leak bug tty: serial: Fix refcount leak bug in ucc_uart.c mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start Liao Chang (1): csky/kprobe: reclaim insn_slot on kprobe unregistration Lin Ma (1): igb: Add lock to avoid data race Logan Gunthorpe (1): md: Notify sysfs sync_completed in md_reap_sync_thread() Luís Henriques (1): ceph: use correct index when encoding client supported features Marc Kleine-Budde (1): can: ems_usb: fix clang's -Wunaligned-access warning Martin Povišer (4): ASoC: tas2770: Set correct FSYNC polarity ASoC: tas2770: Allow mono streams ASoC: tas2770: Drop conflicting set_bias_level power setting ASoC: tas2770: Fix handling of mute/unmute Masahiro Yamada (1): kbuild: fix the modules order between drivers and libs Matthew Wilcox (Oracle) (1): qrtr: Convert qrtr_ports from IDR to XArray Matthias May (3): geneve: do not use RT_TOS for IPv6 flowlabel ipv6: do not use RT_TOS for IPv6 flowlabel geneve: fix TOS inheriting for ipv4 Miaoqian Lin (1): pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map Michael Ellerman (1): powerpc/pci: Fix get_phb_number() locking Michael Grzeschik (1): usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info Mikulas Patocka (1): rds: add missing barrier to release_refill Nathan Chancellor (1): MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Neil Armstrong (1): spi: meson-spicc: add local pow2 clock ops to preserve rate between messages Nikita Travkin (1): pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed Ondrej Mosnacek (1): kbuild: dummy-tools: avoid tmpdir leak in dummy gcc Pablo Neira Ayuso (5): netfilter: nf_tables: really skip inactive sets when allocating name netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified netfilter: nftables: add helper function to set the base sequence number netfilter: add helper function to set up the nfnetlink header and use it Pascal Terjan (1): vboxguest: Do not use devm for irq Pavan Chebbi (1): PCI: Add ACS quirk for Broadcom BCM5750x NICs Peilin Ye (1): vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() Przemyslaw Patynowski (1): iavf: Fix adminq error handling Qifu Zhang (1): Documentation: ACPI: EINJ: Fix obsolete example Richard Guy Briggs (1): audit: log nftables configuration change events once per table Robert Marko (1): clk: qcom: ipq8074: dont disable gcc_sleep_clk_src Roberto Sassu (1): tools build: Switch to new openssl API for test-libcrypto Rustam Subkhankulov (1): net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() Sagi Grimberg (1): nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown Sai Prakash Ranjan (2): irqchip/tegra: Fix overflow implicit truncation warnings drm/meson: Fix overflow implicit truncation warnings Sakari Ailus (1): ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool Samuel Holland (2): pinctrl: sunxi: Add I/O bias setting for H6 R-PIO drm/sun4i: dsi: Prevent underflow when computing packet sizes Sandor Bodo-Merle (1): net: bgmac: Fix a BUG triggered by wrong bytes_compl Schspa Shi (1): vfio: Clear the caps->buf to NULL after free Sebastian Würl (1): can: mcp251x: Fix race condition on receive interrupt Sergei Antonov (2): net: dsa: mv88e6060: prevent crash on an unused port net: moxa: pass pdev instead of ndev to DMA functions Sergey Senozhatsky (1): zram: do not lookup algorithm in backends table Steve French (1): smb3: check xattr value length earlier Steven Rostedt (Google) (3): tracing: Have filter accept "common_cpu" to be consistent selftests/kprobe: Do not test for GRP/ without event failures tracing/probes: Have kprobes and uprobes use $COMM too Takashi Iwai (4): ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper ALSA: control: Use deferred fasync helper Tom Rix (1): apparmor: fix aa_label_asxprint return check Tony Lindgren (1): clk: ti: Stop using legacy clkctrl names for omap4 and 5 Trond Myklebust (5): NFSv4.1: Don't decrease the value of seq_nr_highest_sent NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly NFSv4: Fix races in the legacy idmapper upcall NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Tzung-Bi Shih (1): platform/chrome: cros_ec_proto: don't show MKBP version if unsupported Uwe Kleine-König (2): i2c: imx: Make sure to unregister adapter on remove() dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed Vladimir Oltean (1): net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters Vladimir Zapolskiy (1): clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description Wentao_Liang (1): drivers:md:fix a potential use-after-free bug Xianting Tian (1): RISC-V: Add fast call path of crash_kexec() Xin Xiong (1): apparmor: fix reference count leak in aa_pivotroot() Xiu Jianfeng (1): apparmor: Fix memleak in aa_simple_write_to_buffer() Xuan Zhuo (1): virtio_net: fix memory leak inside XPD_TX with mergeable Ye Bin (1): ext4: avoid remove directory when directory is corrupted Yu Xiao (1): nfp: ethtool: fix the display error of `ethtool -m DEVNAME` Yuanzheng Song (1): tools/vm/slabinfo: use alphabetic order when two values are equal Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES Zheyu Ma (1): video: fbdev: i740fb: Check the argument of i740_calc_vclk() Zhouyi Zhou (1): powerpc/64: Init jump labels before parse_early_param() .../devicetree/bindings/arm/qcom.yaml | 2 +- .../bindings/clock/qcom,gcc-msm8996.yaml | 16 + .../regulator/nxp,pca9450-regulator.yaml | 11 - .../firmware-guide/acpi/apei/einj.rst | 2 +- Makefile | 6 +- arch/csky/kernel/probes/kprobes.c | 4 + arch/mips/cavium-octeon/octeon-platform.c | 3 +- arch/mips/mm/tlbex.c | 4 +- arch/nios2/include/asm/entry.h | 3 +- arch/nios2/include/asm/ptrace.h | 2 + arch/nios2/kernel/entry.S | 22 +- arch/nios2/kernel/signal.c | 3 +- arch/nios2/kernel/syscall_table.c | 1 + arch/powerpc/Makefile | 26 +- arch/powerpc/kernel/pci-common.c | 16 +- arch/powerpc/kernel/prom.c | 7 + arch/powerpc/platforms/Kconfig.cputype | 21 +- arch/riscv/kernel/sys_riscv.c | 5 +- arch/riscv/kernel/traps.c | 4 + arch/um/os-Linux/skas/process.c | 17 +- arch/x86/mm/init_64.c | 2 +- drivers/acpi/pci_mcfg.c | 3 + drivers/acpi/property.c | 8 +- drivers/ata/libata-eh.c | 1 + drivers/block/zram/zcomp.c | 11 +- drivers/clk/qcom/clk-alpha-pll.c | 2 +- drivers/clk/qcom/gcc-ipq8074.c | 1 + drivers/clk/ti/clk-44xx.c | 210 +++++------ drivers/clk/ti/clk-54xx.c | 160 ++++----- drivers/clk/ti/clkctrl.c | 4 - drivers/dma/sprd-dma.c | 5 +- drivers/gpu/drm/meson/meson_drv.c | 5 +- drivers/gpu/drm/meson/meson_viu.c | 22 +- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +- drivers/i2c/busses/i2c-imx.c | 20 +- drivers/infiniband/sw/rxe/rxe_param.h | 6 + drivers/infiniband/sw/rxe/rxe_task.c | 16 +- drivers/irqchip/irq-tegra.c | 10 +- drivers/md/md.c | 1 + drivers/md/raid5.c | 2 +- drivers/misc/cxl/irq.c | 1 + drivers/misc/uacce/uacce.c | 133 ++++--- drivers/mmc/host/meson-gx-mmc.c | 6 +- drivers/mmc/host/pxamci.c | 4 +- drivers/net/can/spi/mcp251x.c | 18 +- drivers/net/can/usb/ems_usb.c | 2 +- drivers/net/dsa/microchip/ksz9477.c | 3 + drivers/net/dsa/mv88e6060.c | 3 + drivers/net/dsa/ocelot/felix_vsc9959.c | 3 +- drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_nic.c | 21 +- drivers/net/ethernet/broadcom/bgmac.c | 2 +- .../net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +- drivers/net/ethernet/freescale/fec_ptp.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_adminq.c | 15 +- drivers/net/ethernet/intel/ice/ice_switch.c | 2 +- drivers/net/ethernet/intel/igb/igb.h | 2 + drivers/net/ethernet/intel/igb/igb_main.c | 12 +- drivers/net/ethernet/moxa/moxart_ether.c | 20 +- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + drivers/net/geneve.c | 15 +- drivers/net/plip/plip.c | 2 +- drivers/net/virtio_net.c | 5 +- drivers/ntb/test/ntb_tool.c | 8 +- drivers/nvme/target/tcp.c | 3 +- drivers/pci/quirks.c | 3 + drivers/pinctrl/intel/pinctrl-intel.c | 14 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/qcom/pinctrl-msm8916.c | 4 +- drivers/pinctrl/qcom/pinctrl-sm8250.c | 2 +- drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c | 1 + drivers/pinctrl/sunxi/pinctrl-sunxi.c | 7 +- drivers/platform/chrome/cros_ec_proto.c | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 20 +- drivers/spi/spi-meson-spicc.c | 129 +++++-- drivers/tee/tee_core.c | 3 + drivers/tee/tee_shm.c | 3 - drivers/tty/serial/ucc_uart.c | 2 + drivers/usb/cdns3/gadget.c | 2 +- drivers/usb/dwc2/gadget.c | 3 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/legacy/inode.c | 1 + drivers/usb/host/ohci-ppc-of.c | 1 + drivers/usb/renesas_usbhs/rza.c | 4 + drivers/vfio/vfio.c | 1 + drivers/video/fbdev/i740fb.c | 9 +- drivers/virt/vboxguest/vboxguest_linux.c | 9 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 4 +- fs/btrfs/tree-log.c | 4 +- fs/ceph/caps.c | 27 +- fs/ceph/mds_client.c | 7 +- fs/ceph/mds_client.h | 6 - fs/cifs/smb2ops.c | 5 +- fs/ext4/namei.c | 7 +- fs/ext4/resize.c | 10 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 13 + fs/nfs/nfs4idmap.c | 46 +-- fs/nfs/nfs4proc.c | 20 +- include/linux/netfilter/nfnetlink.h | 27 ++ include/linux/nmi.h | 2 + include/linux/uacce.h | 6 +- include/sound/control.h | 2 +- include/sound/core.h | 8 + kernel/bpf/arraymap.c | 6 + kernel/bpf/hashtab.c | 2 + kernel/trace/trace_events.c | 1 + kernel/trace/trace_probe.c | 5 +- kernel/watchdog.c | 21 +- lib/list_debug.c | 12 +- net/can/j1939/socket.c | 5 +- net/core/bpf_sk_storage.c | 12 +- net/core/sock_map.c | 20 +- net/ipv6/ip6_output.c | 3 +- net/netfilter/ipset/ip_set_core.c | 17 +- net/netfilter/nf_conntrack_netlink.c | 77 ++--- net/netfilter/nf_tables_api.c | 325 +++++++++--------- net/netfilter/nf_tables_trace.c | 9 +- net/netfilter/nfnetlink_acct.c | 11 +- net/netfilter/nfnetlink_cthelper.c | 11 +- net/netfilter/nfnetlink_cttimeout.c | 22 +- net/netfilter/nfnetlink_log.c | 11 +- net/netfilter/nfnetlink_queue.c | 12 +- net/netfilter/nft_compat.c | 11 +- net/netlink/genetlink.c | 6 +- net/netlink/policy.c | 14 +- net/qrtr/qrtr.c | 42 +-- net/rds/ib_recv.c | 1 + net/sunrpc/auth.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 + net/vmw_vsock/af_vsock.c | 1 + scripts/Makefile.gcc-plugins | 2 +- scripts/dummy-tools/gcc | 8 +- scripts/module.lds.S | 2 + security/apparmor/apparmorfs.c | 2 +- security/apparmor/audit.c | 2 +- security/apparmor/domain.c | 2 +- security/apparmor/include/lib.h | 5 + security/apparmor/include/policy.h | 2 +- security/apparmor/label.c | 13 +- security/apparmor/mount.c | 8 +- security/apparmor/policy_unpack.c | 12 +- sound/core/control.c | 7 +- sound/core/info.c | 6 +- sound/core/misc.c | 94 +++++ sound/core/timer.c | 11 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/tas2770.c | 98 +++--- sound/soc/codecs/tas2770.h | 5 + sound/soc/sof/intel/hda.c | 22 +- sound/usb/card.c | 8 + sound/usb/mixer_maps.c | 34 +- tools/build/feature/test-libcrypto.c | 15 +- tools/perf/util/probe-event.c | 6 +- .../test.d/kprobe/kprobe_syntax_errors.tc | 1 - tools/vm/slabinfo.c | 32 +- 158 files changed, 1458 insertions(+), 1018 deletions(-) -- 2.20.1

1 150

[PATCH openEuler-1.0-LTS] svm: Delete unused ioctl command
by Yongqiang Liu 21 Nov '22

21 Nov '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I61RA3 CVE: NA ------------------------------- The following two ioctl commands are not in used at all. Delete those implementation. SVM_IOCTL_SET_RC SVM_IOCTL_REMAP_PROC Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: chenweilong <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/char/svm.c | 196 ++------------------------------------------- 1 file changed, 5 insertions(+), 191 deletions(-) diff --git a/drivers/char/svm.c b/drivers/char/svm.c index 6b44026252e4..4cd04ca378ff 100644 --- a/drivers/char/svm.c +++ b/drivers/char/svm.c @@ -1484,186 +1484,6 @@ int svm_get_pasid(pid_t vpid, int dev_id __maybe_unused) } EXPORT_SYMBOL_GPL(svm_get_pasid); -static int svm_set_rc(unsigned long __user *arg) -{ - unsigned long addr, size, rc; - unsigned long end, page_size, offset; - pte_t *pte = NULL; - struct mm_struct *mm = current->mm; - - if (acpi_disabled) - return -EPERM; - - if (arg == NULL) - return -EINVAL; - - if (get_user(addr, arg)) - return -EFAULT; - - if (get_user(size, arg + 1)) - return -EFAULT; - - if (get_user(rc, arg + 2)) - return -EFAULT; - - end = addr + size; - if (addr >= end) - return -EINVAL; - - down_read(&mm->mmap_sem); - while (addr < end) { - pte = svm_walk_pt(addr, &page_size, &offset); - if (!pte) { - up_read(&mm->mmap_sem); - return -ESRCH; - } - pte->pte |= (rc & (u64)0x0f) << 59; - addr += page_size - offset; - } - up_read(&mm->mmap_sem); - - return 0; -} - -static long svm_remap_get_phys(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, unsigned long *phys, - unsigned long *page_size, unsigned long *offset) -{ - long err = -EINVAL; - pgd_t *pgd = NULL; - pud_t *pud = NULL; - pte_t *pte = NULL; - - if (mm == NULL || vma == NULL || phys == NULL || - page_size == NULL || offset == NULL) - return err; - - pgd = pgd_offset(mm, addr); - if (pgd_none(*pgd)) - return err; - - pud = pud_offset(pgd, addr); - if (pud_none(*pud)) - return err; - - pte = svm_get_pte(vma, pud, addr, page_size, offset); - if (pte && pte_present(*pte)) { - *phys = PFN_PHYS(pte_pfn(*pte)); - return 0; - } - - return err; -} - -static long svm_remap_proc(unsigned long __user *arg) -{ - long ret = -EINVAL; - struct svm_proc_mem pmem; - struct task_struct *ptask = NULL; - struct mm_struct *pmm = NULL, *mm = current->mm; - struct vm_area_struct *pvma = NULL, *vma = NULL; - unsigned long end, vaddr, phys, buf, offset, pagesize; - - if (!acpi_disabled) - return -EPERM; - - if (arg == NULL) { - pr_err("arg is invalid.\n"); - return ret; - } - - ret = copy_from_user(&pmem, (void __user *)arg, sizeof(pmem)); - if (ret) { - pr_err("failed to copy args from user space.\n"); - return -EFAULT; - } - - if (pmem.buf & (PAGE_SIZE - 1)) { - pr_err("address is not aligned with page size, addr:%pK.\n", - (void *)pmem.buf); - return -EINVAL; - } - - if (pmem.pid) { - ptask = find_get_task_by_vpid(pmem.pid); - if (!ptask) { - pr_err("No task for this pid\n"); - return -EINVAL; - } - } else { - rcu_read_lock(); - ptask = current; - get_task_struct(ptask); - rcu_read_unlock(); - } - - pmm = ptask->mm; - - down_read(&mm->mmap_sem); - down_read(&pmm->mmap_sem); - - pvma = find_vma(pmm, pmem.vaddr); - if (pvma == NULL) { - ret = -ESRCH; - goto err; - } - - vma = find_vma(mm, pmem.buf); - if (vma == NULL) { - ret = -ESRCH; - goto err; - } - - if (pmem.len > SVM_REMAP_MEM_LEN_MAX) { - ret = -EINVAL; - pr_err("too large length of memory.\n"); - goto err; - } - vaddr = pmem.vaddr; - end = vaddr + pmem.len; - buf = pmem.buf; - vma->vm_flags |= VM_SHARED; - if (end > pvma->vm_end || end < vaddr) { - ret = -EINVAL; - pr_err("memory length is out of range, vaddr:%pK, len:%u.\n", - (void *)vaddr, pmem.len); - goto err; - } - - do { - ret = svm_remap_get_phys(pmm, pvma, vaddr, - &phys, &pagesize, &offset); - if (ret) { - ret = -EINVAL; - goto err; - } - - vaddr += pagesize - offset; - - do { - if (remap_pfn_range(vma, buf, phys >> PAGE_SHIFT, - PAGE_SIZE, - __pgprot(vma->vm_page_prot.pgprot | - PTE_DIRTY))) { - - ret = -ESRCH; - goto err; - } - - offset += PAGE_SIZE; - buf += PAGE_SIZE; - phys += PAGE_SIZE; - } while (offset < pagesize); - - } while (vaddr < end); - -err: - up_read(&pmm->mmap_sem); - up_read(&mm->mmap_sem); - put_task_struct(ptask); - return ret; -} - static int svm_proc_load_flag(int __user *arg) { static atomic_t l2buf_load_flag = ATOMIC_INIT(0); @@ -1897,18 +1717,12 @@ static long svm_ioctl(struct file *file, unsigned int cmd, case SVM_IOCTL_GET_PHYS: err = svm_get_phys((unsigned long __user *)arg); break; - case SVM_IOCTL_SET_RC: - err = svm_set_rc((unsigned long __user *)arg); - break; case SVM_IOCTL_PIN_MEMORY: err = svm_pin_memory((unsigned long __user *)arg); break; case SVM_IOCTL_UNPIN_MEMORY: err = svm_unpin_memory((unsigned long __user *)arg); break; - case SVM_IOCTL_REMAP_PROC: - err = svm_remap_proc((unsigned long __user *)arg); - break; case SVM_IOCTL_LOAD_FLAG: err = svm_proc_load_flag((int __user *)arg); break; @@ -1922,12 +1736,12 @@ static long svm_ioctl(struct file *file, unsigned int cmd, err = svm_sp_free_mem((unsigned long __user *)arg); break; default: - err = -EINVAL; - } + err = -EINVAL; + } - if (err) - dev_err(sdev->dev, "%s: %s failed err = %d\n", __func__, - svm_cmd_to_string(cmd), err); + if (err) + dev_err(sdev->dev, "%s: %s failed err = %d\n", __func__, + svm_cmd_to_string(cmd), err); return err; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Revert "posix-cpu-timers: Make timespec to nsec conversion safe"
by Yongqiang Liu 19 Nov '22

19 Nov '22

From: Yuyao Lin <linyuyao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I61XP8 CVE: NA -------------------------------- This reverts commit 098b0e01a91c42aaaf0425605cd126b03fcb0bcf. Function timespec64_to_ns() Add the upper and lower limits check in commit c0b527413194 ("time: Prevent undefined behaviour in timespec64_to_ns()"), timespec64_to_ktime() only check the upper limits, so revert this patch can fix overflow. Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/time/posix-cpu-timers.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c index bfaa44a80c03..5ea7ccfb62b8 100644 --- a/kernel/time/posix-cpu-timers.c +++ b/kernel/time/posix-cpu-timers.c @@ -584,11 +584,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags, if (WARN_ON_ONCE(!p)) return -EINVAL; - /* - * Use the to_ktime conversion because that clamps the maximum - * value to KTIME_MAX and avoid multiplication overflows. - */ - new_expires = ktime_to_ns(timespec64_to_ktime(new->it_value)); + new_expires = timespec64_to_ns(&new->it_value); /* * Protect against sighand release/switch in exit/exec and p->cpu_timers -- 2.25.1

1 0

[PATCH] Revert "posix-cpu-timers: Make timespec to nsec conversion safe"
by Laibin Qiu 19 Nov '22

19 Nov '22

From: Yuyao Lin <linyuyao1(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 186339 -------------------------------- This reverts commit 098b0e01a91c42aaaf0425605cd126b03fcb0bcf. Function timespec64_to_ns() Add the upper and lower limits check in commit c0b527413194 ("time: Prevent undefined behaviour in timespec64_to_ns()"), timespec64_to_ktime() only check the upper limits, so revert this patch can fix overflow. Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- kernel/time/posix-cpu-timers.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c index bfaa44a80c03..5ea7ccfb62b8 100644 --- a/kernel/time/posix-cpu-timers.c +++ b/kernel/time/posix-cpu-timers.c @@ -584,11 +584,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags, if (WARN_ON_ONCE(!p)) return -EINVAL; - /* - * Use the to_ktime conversion because that clamps the maximum - * value to KTIME_MAX and avoid multiplication overflows. - */ - new_expires = ktime_to_ns(timespec64_to_ktime(new->it_value)); + new_expires = timespec64_to_ns(&new->it_value); /* * Protect against sighand release/switch in exit/exec and p->cpu_timers -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/3] Bluetooth: L2CAP: Fix attempting to access uninitialized memory
by Yongqiang Liu 19 Nov '22

19 Nov '22

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v4.19.265 commit 36919a82f335784d86b4def308739559bb47943d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5ZNRS CVE: CVE-2022-42895 -------------------------------- commit b1a2cd50c0357f243b7435a732b4e62ba3157a2e upstream. On l2cap_parse_conf_req the variable efs is only initialized if remote_efs has been set. CVE: CVE-2022-42895 CC: stable(a)vger.kernel.org Reported-by: Tamás Koczka <poprdi(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Reviewed-by: Tedd Ho-Jeong An <tedd.an(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 436a92e3bf20..b6c57a48870a 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3517,7 +3517,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), (unsigned long) &rfc, endptr - ptr); - if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { + if (remote_efs && + test_bit(FLAG_EFS_ENABLE, &chan->flags)) { chan->remote_id = efs.id; chan->remote_stype = efs.stype; chan->remote_msdu = le16_to_cpu(efs.msdu); -- 2.25.1

1 2

用XDP加速Redis PPT
by Zhengzengkai 18 Nov '22

18 Nov '22

1 0

[PATCH OLK-5.10] svm: Delete unused ioctl command
by Zhang Jian 18 Nov '22

18 Nov '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I61RA3 ------------------------------- The following three ioctl command are not in used at all. Delete those implementation. SVM_IOCTL_SET_RC SVM_IOCTL_REMAP_PROC Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/char/svm.c | 192 +-------------------------------------------- 1 file changed, 2 insertions(+), 190 deletions(-) diff --git a/drivers/char/svm.c b/drivers/char/svm.c index 3b591f197af6..6945e93354b4 100644 --- a/drivers/char/svm.c +++ b/drivers/char/svm.c @@ -1085,188 +1085,6 @@ static int svm_open(struct inode *inode, struct file *file) return 0; } -static int svm_set_rc(unsigned long __user *arg) -{ - unsigned long addr, size, rc; - unsigned long end, page_size, offset; - pte_t *pte = NULL; - struct mm_struct *mm = current->mm; - - if (acpi_disabled) - return -EPERM; - - if (arg == NULL) - return -EINVAL; - - if (get_user(addr, arg)) - return -EFAULT; - - if (get_user(size, arg + 1)) - return -EFAULT; - - if (get_user(rc, arg + 2)) - return -EFAULT; - - end = addr + size; - if (addr >= end) - return -EINVAL; - - down_read(&mm->mmap_lock); - while (addr < end) { - pte = svm_walk_pt(addr, &page_size, &offset); - if (!pte) { - up_read(&mm->mmap_lock); - return -ESRCH; - } - pte->pte |= (rc & (u64)0x0f) << 59; - addr += page_size - offset; - } - up_read(&mm->mmap_lock); - - return 0; -} - -static long svm_remap_get_phys(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, unsigned long *phys, - unsigned long *page_size, unsigned long *offset) -{ - long err = -EINVAL; - pgd_t *pgd = NULL; - p4d_t *p4d = NULL; - pud_t *pud = NULL; - pte_t *pte = NULL; - - if (mm == NULL || vma == NULL || phys == NULL || - page_size == NULL || offset == NULL) - return err; - - pgd = pgd_offset(mm, addr); - if (pgd_none(*pgd)) - return err; - - p4d = p4d_offset(pgd, addr); - if (p4d_none(*p4d)) - return err; - - pud = pud_offset(p4d, addr); - if (pud_none(*pud)) - return err; - - pte = svm_get_pte(vma, pud, addr, page_size, offset); - if (pte && pte_present(*pte)) { - *phys = PFN_PHYS(pte_pfn(*pte)); - return 0; - } - - return err; -} - -static long svm_remap_proc(unsigned long __user *arg) -{ - long ret = -EINVAL; - struct svm_proc_mem pmem; - struct task_struct *ptask = NULL; - struct mm_struct *pmm = NULL, *mm = current->mm; - struct vm_area_struct *pvma = NULL, *vma = NULL; - unsigned long end, vaddr, phys, buf, offset, pagesize; - - if (!acpi_disabled) - return -EPERM; - - if (arg == NULL) { - pr_err("arg is invalid.\n"); - return ret; - } - - ret = copy_from_user(&pmem, (void __user *)arg, sizeof(pmem)); - if (ret) { - pr_err("failed to copy args from user space.\n"); - return -EFAULT; - } - - if (pmem.buf & (PAGE_SIZE - 1)) { - pr_err("address is not aligned with page size, addr:%pK.\n", - (void *)pmem.buf); - return -EINVAL; - } - - if (pmem.pid) { - ptask = find_get_task_by_vpid(pmem.pid); - if (!ptask) { - pr_err("No task for this pid\n"); - return -EINVAL; - } - } else { - ptask = current; - } - - pmm = ptask->mm; - - down_read(&mm->mmap_lock); - down_read(&pmm->mmap_lock); - - pvma = find_vma(pmm, pmem.vaddr); - if (pvma == NULL) { - ret = -ESRCH; - goto err; - } - - vma = find_vma(mm, pmem.buf); - if (vma == NULL) { - ret = -ESRCH; - goto err; - } - - if (pmem.len > SVM_REMAP_MEM_LEN_MAX) { - ret = -EINVAL; - pr_err("too large length of memory.\n"); - goto err; - } - vaddr = pmem.vaddr; - end = vaddr + pmem.len; - buf = pmem.buf; - vma->vm_flags |= VM_SHARED; - if (end > pvma->vm_end || end < vaddr) { - ret = -EINVAL; - pr_err("memory length is out of range, vaddr:%pK, len:%u.\n", - (void *)vaddr, pmem.len); - goto err; - } - - do { - ret = svm_remap_get_phys(pmm, pvma, vaddr, - &phys, &pagesize, &offset); - if (ret) { - ret = -EINVAL; - goto err; - } - - vaddr += pagesize - offset; - - do { - if (remap_pfn_range(vma, buf, phys >> PAGE_SHIFT, - PAGE_SIZE, - __pgprot(vma->vm_page_prot.pgprot | - PTE_DIRTY))) { - - ret = -ESRCH; - goto err; - } - - offset += PAGE_SIZE; - buf += PAGE_SIZE; - phys += PAGE_SIZE; - } while (offset < pagesize); - - } while (vaddr < end); - -err: - up_read(&pmm->mmap_lock); - up_read(&mm->mmap_lock); - put_task_struct(ptask); - return ret; -} - static int svm_proc_load_flag(int __user *arg) { static atomic_t l2buf_load_flag = ATOMIC_INIT(0); @@ -1432,18 +1250,12 @@ static long svm_ioctl(struct file *file, unsigned int cmd, case SVM_IOCTL_GET_PHYS: err = svm_get_phys((unsigned long __user *)arg); break; - case SVM_IOCTL_SET_RC: - err = svm_set_rc((unsigned long __user *)arg); - break; case SVM_IOCTL_PIN_MEMORY: err = svm_pin_memory((unsigned long __user *)arg); break; case SVM_IOCTL_UNPIN_MEMORY: err = svm_unpin_memory((unsigned long __user *)arg); break; - case SVM_IOCTL_REMAP_PROC: - err = svm_remap_proc((unsigned long __user *)arg); - break; case SVM_IOCTL_LOAD_FLAG: err = svm_proc_load_flag((int __user *)arg); break; @@ -1451,8 +1263,8 @@ static long svm_ioctl(struct file *file, unsigned int cmd, err = svm_release_phys32((unsigned long __user *)arg); break; default: - err = -EINVAL; - } + err = -EINVAL; + } if (err) dev_err(sdev->dev, "%s: %s failed err = %d\n", __func__, -- 2.17.1

1 0

2024

2023

2022

2021

2020

2019

Kernel