- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19 1/4] Revert "block: call bdput() to avoid memleak"
by Yang Yingliang 05 Aug '21

05 Aug '21

From: Hou Tao <houtao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 55097 CVE: NA ------------------------------------------------- This reverts commit d6dd218da2f8dd56ad7a563d9924222fd9770443. The patch set for partition symlink cleanup will introduce deadlock for nbd, loop and xen-blkfront driver, so revert it. Signed-off-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/genhd.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/block/genhd.c b/block/genhd.c index 657a4cfcc62f1..be938088c440f 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -792,10 +792,8 @@ void del_gendisk(struct gendisk *disk) delete_partition(disk, part->partno); } disk_part_iter_exit(&piter); - if (bdev) { + if (bdev) mutex_unlock(&bdev->bd_mutex); - bdput(bdev); - } invalidate_partition(disk, 0); bdev_unhash_inode(disk_devt(disk)); -- 2.25.1

1 3

[PATCH kernel-4.19 00/30] backport linux-4.19.201
by Yang Yingliang 05 Aug '21

05 Aug '21

Arkadiusz Kubalewski (1): i40e: Fix logic of disabling queues Arnaldo Carvalho de Melo (1): Revert "perf map: Fix dso->nsinfo refcounting" Dan Carpenter (1): can: hi311x: fix a signedness bug in hi3110_cmd() Desmond Cheong Zhi Xi (1): btrfs: fix rw device counting in __btrfs_free_extra_devids Eric Dumazet (2): virtio_net: Do not pull payload in skb->head gro: ensure frag0 meets IP header alignment Florian Westphal (1): netfilter: conntrack: adjust stop timestamp to real expiry value Greg Kroah-Hartman (1): Linux 4.19.201 Hoang Le (1): tipc: fix sleeping in tipc accept routine Jan Kiszka (1): x86/asm: Ensure asm/proto.h can be included stand-alone Jedrzej Jagielski (1): i40e: Fix log TC creation failure when max num of queues is exceeded Jiapeng Chong (1): mlx4: Fix missing error code in mlx4_load_one() Juergen Gross (1): x86/kvm: fix vcpu-id indexed array sizes Junxiao Bi (2): ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks Krzysztof Kozlowski (1): nfc: nfcsim: fix use after free during module unload Lukasz Cieplicki (1): i40e: Add additional info to PHY type error Maor Gottlieb (1): net/mlx5: Fix flow table chaining Marcelo Ricardo Leitner (1): sctp: fix return value check in __sctp_rcv_asconf_lookup Nguyen Dinh Phi (1): cfg80211: Fix possible memory leak in function cfg80211_bss_update Pablo Neira Ayuso (1): netfilter: nft_nat: allow to specify layer 4 protocol NAT only Paul Jakma (1): NIU: fix incorrect error return, missed in previous revert Pavel Skripkin (5): can: mcba_usb_start(): add missing urb->transfer_dma initialization can: usb_8dev: fix memory leak can: ems_usb: fix memory leak can: esd_usb2: fix memory leak net: llc: fix skb_over_panic Srikar Dronamraju (1): powerpc/pseries: Fix regression while building external modules Wang Hai (2): tulip: windbond-840: Fix missing pci_disable_device() in probe and remove sis900: Fix missing pci_disable_device() in probe and remove Makefile | 2 +- arch/powerpc/platforms/pseries/setup.c | 2 +- arch/x86/include/asm/proto.h | 2 + arch/x86/kvm/ioapic.c | 2 +- arch/x86/kvm/ioapic.h | 4 +- drivers/net/can/spi/hi311x.c | 2 +- drivers/net/can/usb/ems_usb.c | 14 ++- drivers/net/can/usb/esd_usb2.c | 16 ++- drivers/net/can/usb/mcba_usb.c | 2 + drivers/net/can/usb/usb_8dev.c | 15 ++- drivers/net/ethernet/dec/tulip/winbond-840.c | 7 +- .../net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 60 ++++++---- drivers/net/ethernet/mellanox/mlx4/main.c | 1 + .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- drivers/net/ethernet/sis/sis900.c | 7 +- drivers/net/ethernet/sun/niu.c | 3 +- drivers/net/virtio_net.c | 10 +- drivers/nfc/nfcsim.c | 3 +- fs/btrfs/volumes.c | 1 + fs/ocfs2/file.c | 103 +++++++++++------- include/linux/skbuff.h | 9 ++ include/linux/virtio_net.h | 14 ++- include/net/llc_pdu.h | 31 ++++-- net/core/dev.c | 3 +- net/llc/af_llc.c | 10 +- net/llc/llc_s_ac.c | 2 +- net/netfilter/nf_conntrack_core.c | 7 +- net/netfilter/nft_nat.c | 4 +- net/sctp/input.c | 2 +- net/tipc/socket.c | 9 +- net/wireless/scan.c | 6 +- tools/perf/util/map.c | 2 - 33 files changed, 241 insertions(+), 126 deletions(-) -- 2.25.1

1 30

[PATCH openEuler-1.0-LTS] sctp: fix return value check in __sctp_rcv_asconf_lookup
by Yang Yingliang 05 Aug '21

05 Aug '21

From: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> stable inclusion from linux-4.19.201 commit d9b6f0a200bef5fb9ba00e4e7d0d51f0b0fa5c6f CVE: CVE-2021-3655 -------------------------------- [ Upstream commit 557fb5862c9272ad9b21407afe1da8acfd9b53eb ] As Ben Hutchings noticed, this check should have been inverted: the call returns true in case of success. Reported-by: Ben Hutchings <ben(a)decadent.org.uk> Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/sctp/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/input.c b/net/sctp/input.c index 3e621582e88b7..e6cc81a12f367 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -1135,7 +1135,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( if (unlikely(!af)) return NULL; - if (af->from_addr_param(&paddr, param, peer_port, 0)) + if (!af->from_addr_param(&paddr, param, peer_port, 0)) return NULL; return __sctp_lookup_association(net, laddr, &paddr, transportp); -- 2.25.1

1 0

【Meeting Notice】openEuler kernel 技术分享第九期 & 双周例会 Time: 2021-08-06 14:00-18:00
by Meeting Book 05 Aug '21

05 Aug '21

1 0

[PATCH openEuler-1.0-LTS] exit: Move preemption fixup up, move blocking operations down
by Yang Yingliang 05 Aug '21

05 Aug '21

From: Jann Horn <jannh(a)google.com> stable inclusion from linux-4.19.129 commit fb020dcd627544e71a34cea6e117ff1a5a0d73c2 -------------------------------- [ Upstream commit 586b58cac8b4683eb58a1446fbc399de18974e40 ] With CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_CGROUPS=y, kernel oopses in non-preemptible context look untidy; after the main oops, the kernel prints a "sleeping function called from invalid context" report because exit_signals() -> cgroup_threadgroup_change_begin() -> percpu_down_read() can sleep, and that happens before the preempt_count_set(PREEMPT_ENABLED) fixup. It looks like the same thing applies to profile_task_exit() and kcov_task_exit(). Fix it by moving the preemption fixup up and the calls to profile_task_exit() and kcov_task_exit() down. Fixes: 1dc0fffc48af ("sched/core: Robustify preemption leak checks") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20200305220657.46800-1-jannh@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/exit.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/kernel/exit.c b/kernel/exit.c index 378fdc19a1fbb..93eaace713474 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -766,8 +766,12 @@ void __noreturn do_exit(long code) struct task_struct *tsk = current; int group_dead; - profile_task_exit(tsk); - kcov_task_exit(tsk); + /* + * We can get here from a kernel oops, sometimes with preemption off. + * Start by checking for critical errors. + * Then fix up important state like USER_DS and preemption. + * Then do everything else. + */ WARN_ON(blk_needs_flush_plug(tsk)); @@ -785,6 +789,16 @@ void __noreturn do_exit(long code) */ set_fs(USER_DS); + if (unlikely(in_atomic())) { + pr_info("note: %s[%d] exited with preempt_count %d\n", + current->comm, task_pid_nr(current), + preempt_count()); + preempt_count_set(PREEMPT_ENABLED); + } + + profile_task_exit(tsk); + kcov_task_exit(tsk); + ptrace_event(PTRACE_EVENT_EXIT, code); validate_creds_for_do_exit(tsk); @@ -802,13 +816,6 @@ void __noreturn do_exit(long code) exit_signals(tsk); /* sets PF_EXITING */ - if (unlikely(in_atomic())) { - pr_info("note: %s[%d] exited with preempt_count %d\n", - current->comm, task_pid_nr(current), - preempt_count()); - preempt_count_set(PREEMPT_ENABLED); - } - /* sync mm's RSS info before statistics gathering */ if (tsk->mm) sync_mm_rss(tsk->mm); -- 2.25.1

1 0

[PATCH kernel-4.19 00/18] backport linux-4.19.200
by Yang Yingliang 05 Aug '21

05 Aug '21

Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Greg Kroah-Hartman (2): selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c Linux 4.19.200 Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Jens Axboe (1): net: split out functions related to registering inflight socket files Maxim Levitsky (1): KVM: x86: determine if an exception has an error code only when injecting it. Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Ruslan Babayev (1): iio: dac: ds4422/ds4424 drop of_node check Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join() Makefile | 2 +- arch/arm/boot/dts/versatile-ab.dts | 5 +- arch/arm/boot/dts/versatile-pb.dts | 2 +- arch/x86/kvm/x86.c | 13 +- drivers/firmware/arm_scmi/driver.c | 12 +- drivers/iio/dac/ds4424.c | 6 - fs/cifs/smb2ops.c | 4 +- fs/hfs/bfind.c | 14 ++- fs/hfs/bnode.c | 25 +++- fs/hfs/btree.h | 7 ++ fs/hfs/super.c | 10 +- include/net/af_unix.h | 1 + include/net/busy_poll.h | 2 +- include/net/sctp/constants.h | 4 +- kernel/workqueue.c | 20 +-- net/802/garp.c | 14 +++ net/802/mrp.c | 14 +++ net/Makefile | 2 +- net/core/sock.c | 2 +- net/sctp/protocol.c | 3 +- net/unix/Kconfig | 5 + net/unix/Makefile | 2 + net/unix/af_unix.c | 102 +++++++--------- net/unix/garbage.c | 68 +---------- net/unix/scm.c | 148 +++++++++++++++++++++++ net/unix/scm.h | 10 ++ tools/testing/selftests/vm/userfaultfd.c | 2 +- 27 files changed, 328 insertions(+), 171 deletions(-) create mode 100644 net/unix/scm.c create mode 100644 net/unix/scm.h -- 2.25.1

1 18

[PATCH openEuler-1.0-LTS 1/2] Input: joydev - prevent potential read overflow in ioctl
by Yang Yingliang 04 Aug '21

04 Aug '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from linux-4.19.178 commit 88438fdeeffe11dcb05c2dd0ddd22cb6e3f024b4 CVE: CVE-2021-3612 -------------------------------- commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream. The problem here is that "len" might be less than "joydev->nabs" so the loops which verfy abspam[i] and keypam[] might read beyond the buffer. Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda [dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP] Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/input/joydev.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c index 4c1e427dfabb9..7ef6e1c165e35 100644 --- a/drivers/input/joydev.c +++ b/drivers/input/joydev.c @@ -460,7 +460,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev, if (IS_ERR(abspam)) return PTR_ERR(abspam); - for (i = 0; i < joydev->nabs; i++) { + for (i = 0; i < len && i < joydev->nabs; i++) { if (abspam[i] > ABS_MAX) { retval = -EINVAL; goto out; @@ -484,6 +484,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, int i; int retval = 0; + if (len % sizeof(*keypam)) + return -EINVAL; + len = min(len, sizeof(joydev->keypam)); /* Validate the map. */ @@ -491,7 +494,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, if (IS_ERR(keypam)) return PTR_ERR(keypam); - for (i = 0; i < joydev->nkey; i++) { + for (i = 0; i < (len / 2) && i < joydev->nkey; i++) { if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) { retval = -EINVAL; goto out; -- 2.25.1

1 1

[PATCH kernel-4.19 1/5] Revert "modpost: explain why we can't use strsep"
by Yang Yingliang 04 Aug '21

04 Aug '21

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46847 CVE: NA ----------------------------------------------- This reverts commit bd34c7e237442f10576363ea3515da4aca39baf1. This series of patches could raise an issue on module built. When we build a module that contains .cpp source file, we could only build the corresponding object file by calling gcc emplicitly instead of using the kbuild framework supplied by kernel. As a consequence, the .cmd file that records the build command for the object file goes missing. This patches series treat that missing .cmd file as a fatal error and break the module build. Although linking a object file supplied by user into a module is informal, the user has already done that and we'd better not break it for compatibility. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- scripts/mod/modpost.c | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index a6f25b67b1cf1..ed5e38df9a7dc 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -166,7 +166,6 @@ char *get_line(char **stringp) if (!orig || *orig == '\0') return NULL; - /* don't use strsep here, it is not available everywhere */ next = strchr(orig, '\n'); if (next) *next++ = '\0'; -- 2.25.1

1 4

[PATCH kernel-4.19] mm/slab: add naive detection of double free
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v5.9-rc1 commit dabc3e291d56e3125113101bc6d53d1a1738294d category: bugfix bugzilla: 41100 CVE: NA ------------------------------------------------- Similar to commit ce6fa91b9363 ("mm/slub.c: add a naive detection of double free or corruption"), add a very cheap double-free check for SLAB under CONFIG_SLAB_FREELIST_HARDENED. With this added, the "SLAB_FREE_DOUBLE" LKDTM test passes under SLAB: lkdtm: Performing direct entry SLAB_FREE_DOUBLE lkdtm: Attempting double slab free ... ------------[ cut here ]------------ WARNING: CPU: 2 PID: 2193 at mm/slab.c:757 ___cache _free+0x325/0x390 [keescook(a)chromium.org: fix misplaced __free_one()] Link: http://lkml.kernel.org/r/202006261306.0D82A2B@keescook Link: https://lore.kernel.org/lkml/7ff248c7-d447-340c-a8e2-8c02972aca70@infradead… Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Randy Dunlap <rdunlap(a)infradead.org> [build tested] Cc: Roman Gushchin <guro(a)fb.com> Cc: Christoph Lameter <cl(a)linux.com> Cc: Alexander Popov <alex.popov(a)linux.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Vinayak Menon <vinmenon(a)codeaurora.org> Cc: Matthew Garrett <mjg59(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Vijayanand Jitta <vjitta(a)codeaurora.org> Link: http://lkml.kernel.org/r/20200625215548.389774-3-keescook@chromium.org Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/slab.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index a818297ef5241..922bfeb94c803 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -630,6 +630,16 @@ static int transfer_objects(struct array_cache *to, return nr; } +/* &alien->lock must be held by alien callers. */ +static __always_inline void __free_one(struct array_cache *ac, void *objp) +{ + /* Avoid trivial double-free. */ + if (IS_ENABLED(CONFIG_SLAB_FREELIST_HARDENED) && + WARN_ON_ONCE(ac->avail > 0 && ac->entry[ac->avail - 1] == objp)) + return; + ac->entry[ac->avail++] = objp; +} + #ifndef CONFIG_NUMA #define drain_alien_cache(cachep, alien) do { } while (0) @@ -810,7 +820,7 @@ static int __cache_free_alien(struct kmem_cache *cachep, void *objp, STATS_INC_ACOVERFLOW(cachep); __drain_alien_cache(cachep, ac, page_node, &list); } - ac->entry[ac->avail++] = objp; + __free_one(ac, objp); spin_unlock(&alien->lock); slabs_destroy(cachep, &list); } else { @@ -3532,7 +3542,7 @@ void ___cache_free(struct kmem_cache *cachep, void *objp, } } - ac->entry[ac->avail++] = objp; + __free_one(ac, objp); } /** -- 2.25.1

1 0

[PATCH kernel-4.19 1/4] iommu/amd: Prevent NULL pointer dereference
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v5.10-rc1 commit 23357b61f8062a8a8c9c84c0252056cd6d849ec8 category: bugfix bugzilla: 43219 CVE: NA ------------------------------------------------ Dereferencing irq_data before checking it for NULL is suboptimal. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Joerg Roedel <jroedel(a)suse.de> Conflicts: drivers/iommu/amd/iommu.c Signed-off-by: Chen Huang <chenhuang5(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/amd_iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index 8148f240aac31..d7a288dd15667 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -4254,8 +4254,8 @@ static int irq_remapping_alloc(struct irq_domain *domain, unsigned int virq, for (i = 0; i < nr_irqs; i++) { irq_data = irq_domain_get_irq_data(domain, virq + i); - cfg = irqd_cfg(irq_data); - if (!irq_data || !cfg) { + cfg = irq_data ? irqd_cfg(irq_data) : NULL; + if (!cfg) { ret = -EINVAL; goto out_free_data; } -- 2.25.1

1 3

2024

2023

2022

2021

2020

2019

Kernel